6440 matches found
PYSEC-2026-1302 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. Patches This vulnerability has been patched in TinyMCE 7.2.0,...
Malicious code in box-ui-elements-usm (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7228 Malicious code in box-ui-elements-usm (npm)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-824 CSV Injection in inventree
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2...
The vulnerability of the NVIDIA deep learning experiment management library runx, related to the failure to take measures to neutralize special elements, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the NVIDIA Deep Learning Experiment Management Library relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and write...
WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin TheGem Theme Elements for Elementor versions = 5.11.1...
DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization
A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and...
The vulnerability of the pgAdmin 4 database management tool, which exists due to the lack of measures to neutralize special elements, allows a hacker to execute arbitrary commands.
The vulnerability of the pgAdmin 4 database management tool exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
CVE-2026-11590
The WP Support Plus Responsive Ticket System WordPress plugin (versions
The vulnerability of the DefaultLdapRealm class in the Apache Shiro framework allows a hacker to bypass security restrictions and perform data substitution.
The vulnerability of the DefaultLdapRealm class in the Apache Shiro framework is related to the failure to eliminate special elements in LDAP requests. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and perform data substitution...
libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate,...
PT-2026-53371
Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider before 5.0.0...
ROS-20260629-73-0017
The vulnerability in Vim relates to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Linux Distros Unpatched Vulnerability : CVE-2026-53182
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: nl80211: reject oversized EMA RNR lists nl80211parsernrelems stores the parsed element count in a u8-backed cfg80211rnrelems::cnt field and uses that coun...
CVE-2026-44696
OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text markdown rendering pipeline uses Sanitize::Config::RELAXED:css for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML...
CVE-2026-56028
Unauthenticated Privilege Escalation in Easy Elements for Elementor Addons & Website Templates = 1.4.9 versions...
EUVD-2026-39691
Unauthenticated Privilege Escalation in Easy Elements for Elementor Addons & Website Templates = 1.4.9 versions...
CVE-2026-56028 WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Easy Elements for Elementor Addons & Website Templates = 1.4.9 versions...