2450 matches found
CVE-2026-14181: Uncaught Exception
@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...
CVE-2026-49091: Improper Encoding or Escaping of Output
Improper Output Neutralization for Logs CWE-117 in Kibana can lead to log injection via Log Injection-Tampering-Forging CAPEC-93. An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal tha...
CVE-2026-13733: Improper Neutralization of Input During Web Page Generation
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nodatamsg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via incorrect validation of file paths in the security policy.relevant. An attacker can create or truncate files outside of intended directories by bypassing configured path restrictions. Details A Directory Traversa...
CVE-2026-12243
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-12243
Removed by vendor...
USN-8481-1: NSS vulnerability
Haruto Kimura discovered that NSS had incorrecty handled parsing PKCS11 URI escape sequences. An attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service, or obtain sensitive information...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
SUSE-SU-2026:22380-1 Security update for loupe
This update for loupe fixes the following issue - CVE-2025-58160: tracing-subscriber: untrusted input containing ANSI escape sequences can lead to terminal manipulation bsc1249009. Changes for loupe: - Update to version 48.2: - Check if the is-hidden property is available before reading it. -...
OPENSUSE-SU-2026:21074-1 Security update for loupe
This update for loupe fixes the following issue - CVE-2025-58160: tracing-subscriber: untrusted input containing ANSI escape sequences can lead to terminal manipulation bsc1249009. Changes for loupe: - Update to version 48.2: - Check if the is-hidden property is available before reading it. -...
GHSA-4C3C-R6P8-C863 Flawfinder output manipulation via untrusted filenames and source text
Impact This vulnerability is an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection: Terminal Output Spoofing: A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder...
Flawfinder output manipulation via untrusted filenames and source text
Impact This vulnerability is an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection: Terminal Output Spoofing: A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder...
GO-2026-5335 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli
GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli...
GO-2026-5067 Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server...
GO-2026-5068 Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode in github.com/inspektor-gadget/inspektor-gadget
Inspektor Gadget uses unsanitized ANSI Escape Sequences In columns Output Mode in github.com/inspektor-gadget/inspektor-gadget...
CVE-2026-53243
CVE-2026-53243 affects the Linux kernel component related to RSEQ (rseq_exit_user_update). The issue is an uninitialized stack variable used in the initialization of the struct rseq_ids, where ids.node_id is derived from ids.cpu_id before it is initialized, enabling potential information leakage....
Security update for iproute2
This update for iproute2 fixes the following issue CVE-2024-58251: denial of service via terminal escape sequences bsc1254324. Other updates: support display of bound but unconnected sockets bsc1204562 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods...
ROS-20260624-73-0025
The vulnerability in Netty is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...