494855 matches found
EUVD-2026-75436
Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...
CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper
Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...
CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper
Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...
CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper
Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...
CVE-2026-88886
Renovate (a dependency update automation tool) before 44.14.7 is affected by a command injection in the manager/gradle-wrapper module. The distributionUrl value read from a repository's gradle-wrapper.properties file is not escaped before invoking the Gradle Wrapper CLI. In self-hosted deployment...
CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...
EUVD-2026-75435
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...
CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...
CVE-2026-88885
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager . When processing unescaped depName parameters in import-path update commands with binarySource=docker mode, attackers can inject shell metacharacters through malicious dependency names to execute arbitrary co...
CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...
CVE-2026-88869
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin 's log.php endpoint. The endpoint fails to escape the label parameter before storage, allowing an unauthenticated attacker to inject malicious HT...
OPENSUSE-SU-2026:21828-1 Security update for ansible-core
This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038
The cookies Node.js library (used by Koa via ctx.cookies) is vulnerable to Set-Cookie attribute injection (CWE-74) in versions before 0.9.2 . The domain and path options are validated against a permissive RFC 7230 field-content matcher that allows semicolons, while the cookie name and value are c...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
EUVD-2026-75398
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-9163 SQLi in GIS Informatics' GisLab Laboratory Management System
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
CVE-2026-9163 SQLi in GIS Informatics' GisLab Laboratory Management System
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...