32152 matches found
EUVD-2026-26979
Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...
CVE-2026-40563
Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...
CVE-2026-40563 Apache Atlas: Script injection allows access to unintended data
Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...
CVE
CVE-PENDING: Bdtask Multi-Store Inventory Management System 1...
OSV-2026-678 UNKNOWN WRITE in ___interceptor_strncpy
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=508899220 Crash type: UNKNOWN WRITE Crash state: interceptorstrncpy concathashstring ndpisearchsshtcp...
ContextualJailbreak: Evolutionary Red-Teaming Via Simulated Conversational Priming
Large language models LLMs remain vulnerable to jailbreak attacks that bypass safety alignment and elicit harmful responses. A growing body of work shows that contextual priming, where earlier turns covertly bias later replies, constitutes a powerful attack surface, with hand-crafted multi-turn...
PT-2026-36788
Name of the Vulnerable Software and Affected Versions Apache Atlas versions 0.8 through 2.4.0 Description An improper control of code generation issue exists in the DSL search endpoint, which accepts user-supplied query strings. An attacker can alter Gremlin traversal logic using grammar-allowed...
Apache Atlas 代码注入漏洞
Apache Atlas is a scalable and extensible core feature governance service developed by the Apache Foundation in the United States. Version 0.8 to 2.4.0 of Apache Atlas contains a code injection vulnerability. This vulnerability stems from the DSL search endpoint accepting query strings provided b...
PT-2026-36901
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1 Description A flaw in the SeaTable node's 'row:search' and 'row:get' operations allows user-controlled input to be concatenated directly into SQL query...
PT-2026-37049
Name of the Vulnerable Software and Affected Versions Net::IMAP versions prior to 0.4.24 Net::IMAP versions prior to 0.5.14 Net::IMAP versions prior to 0.6.4 Description Several commands in the Net::IMAP Ruby library accept raw string arguments that are sent to the server without validation or...
EUVD-2026-26779
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'mapposttype' parameter in all versions up to, and including, 1.13.18. This is due to the SearchResults hook explicitly calling stripslashesdeep$POST which removes WordPress magic quotes protection, followed by...
mcp-exploitdb-query
mcp-exploitdb-query MCP server to query ExploitDB. This serv...
PT-2026-36607
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map post type' parameter in all versions up to, and including, 1.13.18. This is due to the SearchResults hook explicitly calling stripslashes deep$ POST which removes WordPress magic quotes protection, followed...
WordPress Ivory Search – WordPress Search Plugin plugin <= 5.5.8 - Unauthenticated Reflected Cross-Site Scripting vulnerability
Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Ivory Search versions = 5.5.8...
@diplodoc/algolia (>=0.1.0, <=0.4.1), @diplodoc/algolia-extension (>=0.4.1, <=0.6.1) +1 more potentially affected by CVE-2026-40201 via @diplodoc/search-extension (1.2.2)
@diplodoc/search-extension NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on @diplodoc/search-extension and may be impacted: - @diplodoc/algolia =0.1.0, =0.4.1, =0.0.0-rc-add-filemeta-to-boost-testing-202410220924, =5.0.0-alpha-8 Source...
@diplodoc/algolia (>=0.1.0, <=0.4.1), @diplodoc/algolia-extension (>=0.4.1, <=0.6.1) +1 more potentially affected by CVE-2026-40201 via @diplodoc/search-extension (1.2.2)
@diplodoc/search-extension NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on @diplodoc/search-extension and may be impacted: - @diplodoc/algolia =0.1.0, =0.4.1, =0.0.0-rc-add-filemeta-to-boost-testing-202410220924, =5.0.0-alpha-8 Source...
GHSA-RJMP-RWJ4-MV82 @diplodoc/search-extension allows stored XSS via Markdown file title
@diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title...
@diplodoc/search-extension allows stored XSS via Markdown file title
@diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title...
Cross-site Scripting (XSS)
Overview @diplodoc/search-extension is a Lunr based offline search extension for Diplodoc platform Affected versions of this package are vulnerable to Cross-site Scripting XSS in the title field of Markdown files. An attacker can execute arbitrary scripts in the context of the user's browser by...
