119069 matches found
CVE-2026-55600
Part-DB, an open source inventory management system for electronic components, is vulnerable to a cross-user stored HTML injection in versions prior to 2.12.2 . The root cause is the use of Twig's |raw filter to render BOM validation messages containing user-controlled Part names without proper e...
CVE-2026-55600
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...
CVE-2026-55600 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...
CVE-2026-55600 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...
CVE-2026-55600 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...
CVE-2026-54615 Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...
CVE-2026-54615
The open source inventory management system Part-DB is vulnerable to stored cross-site scripting (XSS) and HTML injection prior to version 2.12.1 . The root cause is a sanitizer gap in LogEntryExtraFormatter::getInternalFormat() where the CollectionElementDeleted branch fails to escape getOldName...
EUVD-2026-108572
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...
CVE-2026-54615 Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...
CVE-2026-54615
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...
CVE-2026-54615 Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...
CLEANSTART-2026-UV08915 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
Security vulnerability affects the argo-cd package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...
CLEANSTART-2026-LC82516 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the argo-cd package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-IC75127 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the argo-cd package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-WH85433 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
Security vulnerability affects the argo-cd package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
CLEANSTART-2026-RL86772 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the argo-cd package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-SU80167 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the argo-cd package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
PT-2026-121772
Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 7.9.2 Description An issue exists where an HTML rewriting routine is not restricted to stylesheet content, causing the removal of a quote that terminates an attribute in the rendered page. Whe...