69514 matches found
GHSA-HJ66-6F7G-4R5V Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...
CVE-2026-97711
A flaw was found in serialize-javascript. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying crafted function code containing unescaped script-closing tags. When the serialized function is embedded within an HTML script element, the unescaped tag...
DEBIAN-CVE-2026-97711
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-97711
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-102630
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...
CVE-2026-97711
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-97711
The serialize-javascript library is vulnerable to cross-site scripting (XSS) in versions 7.1.1 through 7.1.2 . The root cause is that the SCRIPT_CLOSE_REGEXP can consume a second closing tag within a single match, failing to fully protect serialized function values against script-closing tags. If...
CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-97711
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-93759
A flaw was found in Mongoid where it fails to properly neutralize string-typed query criteria. This vulnerability allows an unauthenticated attacker to inject server-side JavaScript expressions into database queries. Successful exploitation can lead to the unintended disclosure of sensitive store...
Malicious code in dotenv-preflight (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0 The npm package [email protected] presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily...
CVE-2026-100825
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
DEBIAN-CVE-2026-100825
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
DEBIAN-CVE-2026-100814
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
CVE-2026-100813
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...