118430 matches found
EUVD-2026-98934
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...
CVE-2026-110101 Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...
CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
CVE-2026-102989
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
SUSE-SU-2026:24239-1 Security update for go1.26
This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...
OPENSUSE-SU-2026:22095-1 Security update for go1.26
This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...
CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...
CVE-2026-109960
Froxlor versions 2.0.0 before 2.3.14 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. Authenticated customers can inject malicious HTML and JavaScript by providing a craftied theme value via customer_index.php . The payload executes in an administrator's browser when they view the cust...
CVE-2026-109780
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...
CVE-2026-109725
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
DEBIAN-CVE-2026-109725
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109724
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
DEBIAN-CVE-2026-109724
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109780
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...
UBUNTU-CVE-2026-109780
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...
CVE-2026-109724
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...