Lucene search
+L

6763 matches found

Positive Technologies
Positive Technologies
added 2026/05/08 12:00 a.m.25 views

PT-2026-38648

Name of the Vulnerable Software and Affected Versions electerm versions 3.x and earlier Description The getConstants IPC handler in src/app/lib/ipc-sync.js serializes the entire process.env object and sends it to the renderer, where it is stored as window.pre.env. This data is accessible to any...

6.5CVSS5.8AI score0.00103EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/05/08 12:00 a.m.27 views

PT-2026-38651

Name of the Vulnerable Software and Affected Versions Kimai versions 2.32.0 through 2.55.x Description Users with the System-Admin role ROLE SYSTE ADMIN and the upload invoice template permission can upload PDF invoice templates that execute pdfContext.setOption'associated files', ... within the...

4.9CVSS5.8AI score0.00278EPSS
SaveExploits0References7
NVD
NVD
added 2026/05/07 10:16 p.m.35 views

CVE-2026-41929

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and componentajax POST parameter. Attackers can craft a malicious link or...

6.1CVSS0.00198EPSS
SaveExploits0References4
OSV
OSV
added 2026/05/07 9:18 p.m.20 views

GHSA-3V85-FQVH-7RXF Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

Summary The public RSS/Atom feed at /rss renders two attacker-controlled surfaces without HTML escaping. Tag names flow through fmt.AppendfrenderedContent, "%s", tag.Name at internal/service/common/common.go:120, and the Markdown renderer at internal/util/md/md.go does not set the html.SkipHTML...

4.8CVSS5.9AI score
SaveExploits0References3
CVE
CVE
added 2026/05/07 9:08 p.m.45 views

CVE-2026-41929

CVE-2026-41929 affects Vvveb prior to 1.0.8.2, where an unauthenticated reflected XSS can be triggered via the visual editor preview renderer by manipulating the r query parameter and _component_ajax POST data. The root cause is inadequate input handling: isEditor() lacks session/role/token check...

6.1CVSS5.9AI score0.00198EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/07 9:08 p.m.21 views

EUVD-2026-28459

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and componentajax POST parameter. Attackers can craft a malicious link or...

6.1CVSS5.9AI score0.00198EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/05/07 9:08 p.m.56 views

CVE-2026-41929 Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and componentajax POST parameter. Attackers can craft a malicious link or...

6.1CVSS0.00198EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/05/07 9:08 p.m.17 views

CVE-2026-41929

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and componentajax POST parameter. Attackers can craft a malicious link or...

6.1CVSS5.9AI score0.00198EPSS
SaveExploits0References5
NVD
NVD
added 2026/05/07 3:16 p.m.19 views

CVE-2026-44264

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1...

4.3CVSS0.00275EPSS
SaveExploits0References4
OSV
OSV
added 2026/05/07 3:16 p.m.10 views

PYSEC-2026-2319

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1...

4.3CVSS6AI score0.00275EPSS
SaveExploits0References4
OSV
OSV
added 2026/05/07 6:00 a.m.18 views

RLSA-2026:13537 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS CVE-2026-6772 firefox: thunderbird: Use-after-free in the JavaScript Engine component CVE-2026-6754 firefox: thunderbird: Spoofing...

7.5CVSS6AI score0.04938EPSS
SaveExploits2References26
Github Security Blog
Github Security Blog
added 2026/05/07 12:04 a.m.38 views

Weblate vulnerable to XSS via crafted Markdown

Impact The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. Patches https://github.com/WeblateOrg/weblate/pull/19259 Workarounds Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should...

4.3CVSS5.8AI score0.00275EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/05/07 12:04 a.m.23 views

GHSA-5CMV-3RC4-7279 Weblate vulnerable to XSS via crafted Markdown

Impact The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. Patches https://github.com/WeblateOrg/weblate/pull/19259 Workarounds Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should...

4.3CVSS5.8AI score0.00275EPSS
SaveExploits0References6
Snyk
Snyk
added 2026/05/07 12:04 a.m.8 views

Cross-site Scripting (XSS)

Overview weblate is an A web-based continuous localization system with tight version control integration Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Markdown renderer used for user comments and other user-provided content due to improper sanitization of...

5.3CVSS5.5AI score0.00275EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/05/07 12:00 a.m.12 views

Linux Distros Unpatched Vulnerability : CVE-2026-7960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive...

5.3CVSS6.3AI score0.00176EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/05/07 12:00 a.m.35 views

PT-2026-38401

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17.1 Description The Markdown renderer used in user comments and other user-provided content fails to properly sanitize certain attributes, which could allow the injection of code into the HTML. Recommendations Upda...

4.3CVSS5.9AI score0.00275EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/05/07 12:00 a.m.25 views

PT-2026-38586

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2 Description An unauthenticated reflected cross-site scripting issue exists in the visual editor preview renderer. Attackers can execute arbitrary JavaScript by manipulating the r query parameter and component aj...

6.1CVSS5.8AI score0.00198EPSS
SaveExploits0References8
CNNVD
CNNVD
added 2026/05/07 12:00 a.m.20 views

Vvveb 跨站脚本漏洞

Vvveb is a powerful and easy-to-use CMS developed by Givan’s developers, used for building websites, blogs, or e-commerce stores. Versions of Vvveb prior to 1.0.8.2 had a cross-site scripting vulnerability. This vulnerability stemmed from an unvalidated reflective cross-site scripting flaw in the...

6.1CVSS5.9AI score0.00198EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/05/07 12:00 a.m.17 views

Weblate 安全漏洞

Weblate is an open-source, copyleft, web-based free software system for continuous localization. Versions of Weblate prior to 5.17.1 contained a security vulnerability, which was caused by the Markdown renderer used in user comments and other user-generated content not properly cleaning certain...

4.3CVSS5.8AI score0.00275EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/05/07 12:00 a.m.11 views

Linux Distros Unpatched Vulnerability : CVE-2026-7955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially...

5.3CVSS6.3AI score0.0024EPSS
SaveExploits0References2
Rows per page
Query Builder