CVE-2026-90443 Cross-site Scripting in Malcolm

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

CVE-2026-90443 Cross-site Scripting in Malcolm

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

PT-2026-90511

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding. This issue does not require...

CVE-2026-86257

CVE-2026-86257 affects wger before version 2.6 . The root cause is a lack of sanitization on the first_name and last_name fields in the gym member TSV export endpoint , enabling any gym member to inject spreadsheet formulas such as =HYPERLINK. When an admin opens the exported file in Excel or Lib...

[SECURITY] Fedora 43 Update: rust-anstyle-hyperlink-1.0.2-1.fc43

ANSI escape code hyperlinks OSC 8...

[SECURITY] Fedora 44 Update: rust-anstyle-hyperlink-1.0.2-1.fc44

ANSI escape code hyperlinks OSC 8...

Fedora 43 : rust-anstyle-hyperlink / rust-anstyle-progress / rust-cargo / etc (2026-ce685f40fe)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ce685f40fe advisory. - Update cargo-c to version 0.10.24 plus dependency updates. - Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates...

Fedora 45 : rust-anstyle-hyperlink / rust-anstyle-progress / rust-cargo / etc (2026-67365d8467)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-67365d8467 advisory. - Update cargo-c to version 0.10.24 plus dependency updates. - Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates...

Fedora 46 : rust-anstyle-hyperlink / rust-anstyle-progress / rust-cargo / etc (2026-ce471fc0d3)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ce471fc0d3 advisory. - Update cargo-c to version 0.10.24 plus dependency updates. - Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates...

terminal-poc-corpus

terminal-poc-corpus A defensive, machine-readable corpus...

CVE-2026-59209

creationtimestamp| type| source ---|---|--- 2026-07-13 20:19:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkjbu6ku52x 2026-07-16 08:09:43+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrvaahjn2i...

PYSEC-2026-2217

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...

CVE-2026-57245

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an...

CVE-2026-57245

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an...

EUVD-2026-42207

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an...

CVE-2026-57245

Foxit PDF Editor/Reader contains a use-after-free vulnerability in the handling of hyperlink annotations when opening and traversing annotation elements. The issue can lead to an invalid state and an invalid pointer write during destruction, causing a crash. CVSSv3.1 base score 7.8 ( HIGH ) with ...

CVE-2026-57245 Foxit PDF Editor/Reader Signature Hyperlink Use-After-Free Vulnerability

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an...

PT-2026-56344

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an...

PT-2026-51455

Name of the Vulnerable Software and Affected Versions Actual versions prior to 26.6.0 Description Actual is a local-first personal finance tool that fails to neutralize formula-trigger characters when exporting data to CSV. The functions exportToCSV and exportQueryToCSV in...

CVE-2026-47090

Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can...