151343 matches found
CVE-2026-57501
Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...
CVE-2026-59833 SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with sanitization enabled, but Lute's dangerous javascript scheme block does not check form action or SVG xlink:href attributes, allowing stored...
MINI-Q59C-MVH6-5F2F
Bulletin has no description...
MINI-P4MM-JF83-XMWR
Bulletin has no description...
MINI-W853-QFR4-MVMR
Bulletin has no description...
MINI-G359-62V2-9WPG
Bulletin has no description...
CVE-2026-55604 @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...
CVE-2026-57029
CVE-2026-57029 describes a missing synchronization vulnerability in the flow collector handler of Junos OS Evolved on QFX Series. When the reachability of an sFlow collector changes, updating the next-hop entry can race with the sFlow thread accessing the same data, causing the evo-pfemand proces...
CVE-2026-57029
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service DoS. When the reachability of an sFlow collector changes, the corresponding next-hop entry is...
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
Summary YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the...
MINI-C8F6-XXGG-45HJ
Bulletin has no description...
GHSA-G33C-4GX6-V8XR vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-13803 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-13846 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-14110 vulnerabilities
Vulnerabilities for packages: chromium...
MINI-VWWG-RFCX-8G6R
Bulletin has no description...
MINI-3P85-9874-W6QG
Bulletin has no description...
MINI-W982-9W78-5FM4
Bulletin has no description...