CVE-2026-35571

CVE-2026-35571 affects Emissary prior to 8.39.0. Mustache navigation templates interpolated config-controlled link values directly into href attributes without URL scheme validation, allowing an administrator with navItems access to inject javascript: URIs and trigger stored XSS against other aut...

NocoDB has Stored Cross-site Scripting via Formula Cell

Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI:: patterns are rendered via v-html without sanitization, allowing injected HTML to execute. Details The replaceUrlsWithLink function in urlUtils.ts converts URI::url patterns to tags but passes a...

CVE-2026-27593

Statamic CMS (Laravel/Git-based) is affected by CVE-2026-27593 via a password-reset vulnerability. Prior to versions 6.3.3 and 5.73.10, an attacker who knows a valid account’s email could capture a reset token and reset the password on behalf of the user, who must click the reset link in their em...

GHSA-JXQ9-79VJ-RGVW Statamic is vulnerable to account takeover via password reset link injection

Impact An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they...

Statamic is vulnerable to account takeover via password reset link injection

Impact An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they...

CVE-2024-39863

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

pretix has Email Content Injection Through Maliciously Formatted Names

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when name is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML i...

EUVD-2014-3032

Malware in sbrugna...

EUVD-2017-10568

Malware in sbrugna...

EUVD-2021-19355

Malware in sbrugna...

EUVD-2010-2334

Malware in sbrugna...

EUVD-2013-5251

Malware in sbrugna...

EUVD-2021-16150

Malware in sbrugna...

EUVD-2013-6135

Malware in sbrugna...

EUVD-2014-1000

Malware in sbrugna...

EUVD-2025-21019

Malicious code in bioql PyPI...

EUVD-2022-3263

Malicious code in bioql PyPI...

EUVD-2022-5594

Malicious code in bioql PyPI...

EUVD-2021-6942

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2017-6932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in...