3831 matches found
Django: Django: Denial of Service via crafted HTML inputs
A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the django.utils.text.Truncator.chars and Truncator.words methods when html=True, or through the truncatecharshtml and truncatewordshtml...
CVE-2026-33080
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers Range, Values that render raw database values without escaping HTML. If there is a lack of validation for the data in the...
CVE-2026-27664
A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V26.10, SICORE Base system All versions V26.10.0. The affected application contains an out-of-bounds write vulnerability while parsing specially crafted XML inputs. This could allow an unauthenticated...
GHSA-73VX-49MV-V8W5 MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline
Improper escaping of tag names retrieved from History in Timeline myviewpage.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted. Impact Cross-site scripting XSS. Patches...
CVE-2026-33696 n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE
n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the XML and the GSuiteAdmin nodes. By supplying a crafted parameters as part...
SUSE CVE-2026-4674
Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...
The vulnerability of the libexpat library for analyzing XML files, related to integer overflow, allows attackers to cause a service failure.
The vulnerability of the libexpat library for analyzing XML files is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2026-4726
Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...
CVE-2026-4726
Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...
EUVD-2026-14686
Integer overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...
Cross-site Scripting (XSS)
Overview actionview is a simple, battle-tested conventions and helpers for building web pages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via custom HTML attributes passed in to tag helpers. An attacker can inject scripts that may be executed in the context of th...
The vulnerability of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) access control systems relates to reading values beyond the allowed range in memory. This allows attackers to bypass existing security mechanisms.
The vulnerability of NetScaler ADC formerly Citrix ADC and the NetScaler Gateway access control system formerly Citrix Gateway relates to reading data beyond the allowed range in memory. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms by sending...
DEBIAN-CVE-2026-33168
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefull...
Rails has a possible XSS vulnerability in its Action View tag helpers
Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Application...
GHSA-V55J-83PF-R9CQ Rails has a possible XSS vulnerability in its Action View tag helpers
Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Application...
esaml XXE vulnerability allows local file disclosure and SSRF via crafted SAML messages
XML External Entity XXE vulnerability in esaml and its forks allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages. esaml parses attacker-controlled SAML messages using...
Google Chrome 资源管理错误漏洞
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a resource management error vulnerability that can be exploited by an attacker to cause arbitrary code to be executed in the sandbox via specially crafted HTML pages...
PT-2026-27279
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.165 Description A use-after-free issue exists in the WebGPU component of Google Chrome. This flaw could allow a remote attacker to execute arbitrary code within a sandbox through a specially crafted...
