Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI that is open source. Versions of Open WebUI prior to 0.9.0 had a cross-site scripting vulnerability. This vulnerability stemmed from the AccountPending.svelte component using marked.parse to render...

PT-2026-41363

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html...

PT-2026-41342

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application. Attackers can craft malicious markdown files with embedded JavaScript that executes system commands...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to a countable loss of significance. This vulnerability allows attackers to trigger a service failure.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, involves a countable loss of significance. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to uncontrolled resource consumption. This vulnerability allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures...

MiracleLinux 9 : thunderbird-140.10.0-1.el9_7.ML.1 (AXSA:2026-616:11)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-616:11 advisory. firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS CVE-2026-6772 firefox: thunderbird: Use-after-free in the...

PT-2026-41341

Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows authenticated attackers to inject malicious HTML and JavaScript code. Attackers can inject script payloads into user profile fields at the edit user endpoint, which execute in t...

PT-2026-41369

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to a countable loss of significance. This vulnerability allows attackers to trigger a service failure.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, involves a countable loss of significance. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to uncontrolled resource consumption. This vulnerability allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to uncontrolled resource consumption. This vulnerability allows attackers to trigger service failures.

The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow attackers to cause service failures...

vm2 Has a Sandbox Breakout Using Async Generator

Summary VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. Details It is possible to catch a host exception using the yield expression inside an async generator. When the...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

firefox: thunderbird: Use-after-free in the JavaScript Engine component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component...