385 matches found
CLEANSTART-2024-DK66902 As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation
Security vulnerability affects the firefox-esr package. As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation...
CVE-2026-117607 Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...
CVE-2026-117607 Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...
CVE-2026-117607
The Xerte Online Toolkits software (versions through 3.15.5 ) is vulnerable to Remote Code Execution (RCE) . This issue allows authenticated users with system permissions to execute PHP by importing a crafted language pack. The root cause involves the import_language.php functionality, where an a...
CVE-2026-117607 Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...
PT-2026-127731
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import language.php containing a .inc file, then request it through the langua...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
PYSEC-2026-4059 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
GHSA-3JQQ-PW4J-PQCJ JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
EUVD-2026-89337
JupyterLab: Cross-site scripting XSS in JupyterLab via crafted language package jupyterlab.json...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
PT-2026-105812
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
PT-2026-105815
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
Linux Distros Unpatched Vulnerability : CVE-2026-102830
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5....
CVE-2026-102830
A flaw was found in JupyterLab. Incomplete validation of language pack headers allows arbitrary JavaScript code to be injected and executed during string translation. An attacker could exploit this flaw by enticing a user to load a malicious third-party language pack, resulting in code execution...
Description of the security update for SharePoint Server 2016 Language Pack: June 9, 2026 (KB5002881)
Description of the security update for SharePoint Server 2016 Language Pack: June 9, 2026 KB5002881 Applies To SharePoint Server 2016 Summary Important If you're running Microsoft SharePoint Server 2013-type workflows, you must install the August 2025 update for SharePoint Workflow Manager to you...
CVE-2026-6539
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through...
Description of the security update for SharePoint Server 2016 Language Pack: May 12, 2026 (KB5002869)
Description of the security update for SharePoint Server 2016 Language Pack: May 12, 2026 KB5002869 Applies To SharePoint Server 2016 Summary Important If you're running Microsoft SharePoint Server 2013-type workflows, you must install the August 2025 update for SharePoint Workflow Manager to you...
Description of the security update for SharePoint Server 2019 Language Pack: May 12, 2026 (KB5002872)
Description of the security update for SharePoint Server 2019 Language Pack: May 12, 2026 KB5002872 Applies To SharePoint Server 2019 Summary Important If you're running 2013-type workflows, you must install the August 2025 update for SharePoint Workflow Manager to your farm before you install th...
CVE-2026-6539
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through...