Malicious code in crenelatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ccd88fc743d2fd427510543af873fff8780bb4ec4916a565afb729315f28068 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

CVE-2026-114130

The Nuxt web development framework for Vue.js is vulnerable to a cross-site scripting (XSS) issue prior to version 4.6.0 . When the pages feature is disabled, the no-pages router incorrectly classifies an attacker-controlled input as an internal route if it is prefixed with an ASCII C0 control ch...

Vite: Cross origin script execution through Vite custom middleware

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...

GHSA-9JRQ-W75R-8GCW Vite: Cross origin script execution through Vite custom middleware

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...

NPM: Vite: Cross origin script execution through Vite custom middleware

NPM: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

NPM: Vite: Cross origin script execution through Vite custom middleware

NPM: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

gitbook-xss

gitbook-xss CVE-2019-19596 GitBook through 2.6.9 allows XSS via a local .md file By entering script in MD file, it can be executed by gitbook...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

OpenNebula-CVE-2025-56534

OpenNebula-CVE-2025-56534 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in the custom authenticator driver Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix :...

CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

CVE-2026-112945

A flaw was found in Vite. An attacker can achieve arbitrary script execution in a user's browser by convincing a victim to load a crafted development server page when an application uses custom middleware. Due to improper handling of leading slashes in request URLs during HTML transformation, the...

CVE-2026-113657

A flaw was found in sanitize-html. This vulnerability allows a remote attacker to achieve arbitrary script execution when an application is configured to permit namespace-prefixed Scalable Vector Graphics SVG animation elements. By submitting specially crafted SVG markup, an attacker can bypass U...

CVE-2026-113659

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the specia...