Cross-site Scripting (XSS)

Overview org.webjars.npm:jsondiffpatch is a JSON diff & patch object and array diff, text diff, multiple output formats Affected versions of this package are vulnerable to Cross-site Scripting XSS via the annotated formatter due to improper sanitization of JSON values and property names. If an...

RHSA-2026:7885 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0.18 (golang-github-openstack-k8s-operators-os-diff) security update

Bulletin has no description...

patchbot

patchbot patchbot is an AI-assisted security reviewer for p...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, helm-diff, kots, helm-diff-fips, zarf, gitlab-operator-fips, rancher-fleet, rancher-fleet-fips, helm-push, zarf-fips, cert-manager-cmctl, gitlab-operator, flux-fips, flux, flux-source-controller-fips, kuma, cilium-cli, flux-source-controller...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, helm-diff, kots, helm-diff-fips, zarf, gitlab-operator-fips, rancher-fleet, rancher-fleet-fips, helm-push, zarf-fips, cert-manager-cmctl, gitlab-operator, flux-fips, flux, flux-source-controller-fips, kuma, cilium-cli, flux-source-controller...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, helm-diff, kots, helm-diff-fips, zarf, gitlab-operator-fips, rancher-fleet, rancher-fleet-fips, helm-push, zarf-fips, cert-manager-cmctl, gitlab-operator, flux-fips, flux, flux-source-controller-fips, kuma, cilium-cli, flux-source-controller...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, helm-diff, kots, helm-diff-fips, zarf, gitlab-operator-fips, rancher-fleet, rancher-fleet-fips, helm-push, zarf-fips, cert-manager-cmctl, gitlab-operator, flux-fips, flux, flux-source-controller-fips, kuma, cilium-cli, flux-source-controller...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: k8ssandra-client, consul-k8s-fips, teleport, chaos-mesh-fips, cerbos-fips, cerbos, cluster-api-helm-controller-fips, headlamp-fips, nova-fips, linkerd2, helm-operator, helm-operator-fips, zarf-fips, cilium-cli, envoy-gateway-fips, kube-arangodb-fips, kubescape-server...

CVE-2026-34401 XML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading

XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related...

CVE-2026-34401 XML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading

XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related...

CVE-2026-34401

XML Notepad is affected by an XXE flaw in which DTD processing was not disabled by default prior to version 2.9.0.21, allowing external entities to be resolved. The issue could cause the application to make outbound HTTP/SMB requests and potentially leak local file contents or NTLM credentials. T...

CVE-2026-34401 XML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading

XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related...

JLSEC-2026-14

An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuitdifftype function in pch.c, aka a "mangled rename" issue...

consult-llm-mcp 操作系统命令注入漏洞

consult-llm-mcp is a multi-model code consultation server developed by Raine Virta. Versions of consult-llm-mcp prior to 2.5.3 had an operating system command injection vulnerability. This vulnerability stemmed from incorrect operations with parameters gitdiff.baseref/gitdiff.files in the...

CVE-2026-33718

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...

CVE-2026-33955

Notesnook: A stored XSS in the note history diff viewer (Web/Desktop) can lead to remote code execution in the desktop app. Trigger occurs when an attacker-controlled note header is rendered with dangerouslySetInnerHTML, and, when combined with the full backup/restore feature, is exploitable due ...

CVE-2026-33718

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...

PYSEC-2026-106

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...

PYSEC-2026-106

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...

CVE-2026-33718 OpenHands is Vulnerable to Command Injection through its Git Diff Handler

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...