248 matches found
CVE-2026-78392
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication a...
EUVD-2026-108018
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication a...
PT-2026-110655
Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.7.0 through 0.9.3 Description A server-side request forgery SSRF issue exists where API clients can access internal addresses. By enabling link preview config on the '/crawl' endpoint, an attacker can provide a controlled...
Astra Linux – Vulnerability in Chromium
The inappropriate implementation in the Link Preview component of Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...
CVE-2026-103532
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
EUVD-2026-90451
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
CVE-2026-103532
The immich-app Immich software, version up to 2.7.5 , is vulnerable to an improper authorization flaw. The issue resides in the Shared Link Preview Handler component, specifically within the checkSharedLinkAccess function of the server/src/utils/access.ts file. By manipulating the Password argume...
CVE-2026-103532
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
CVE-2026-103532: Improper Authorization
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
PT-2026-103656
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
ROS-20260911-73-0202
The vulnerability of the Link Preview function in browsers such as Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...
@kaikybrofc/zyra (0.2.4) potentially affected by CVE-2026-43897 +1 more via link-preview-js (4.0.3)
link-preview-js NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on link-preview-js and may be impacted: - @kaikybrofc/zyra 0.2.4 Source cves: CVE-2026-43897, CVE-2026-61704 Source advisory: GHSA-CPJF-6666-R8FX...
GHSA-CPJF-6666-R8FX link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 vulnerability discovered by ? in WordPress Npm link-preview-js versions = 4.0.3...
@kaikybrofc/zyra (0.2.4) potentially affected by CVE-2026-61704 via link-preview-js (4.0.3)
link-preview-js NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on link-preview-js and may be impacted: - @kaikybrofc/zyra 0.2.4 Source cves: CVE-2026-61704 Source advisory: OSV:GHSA-CPJF-6666-R8FX...