CVE-2026-41234 Froxlor: BIND Zone File Injection via TXT Record Content

Froxlor is open source server administration software. Prior to version 2.3.7, the DomainZones.add API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record...

ROOT-APP-PYPI-CVE-2026-41481 CVE-2026-41481 in rootio-langchain-text-splitters - Patched by Root

Root has patched CVE-2026-41481 in the rootio-langchain-text-splitters package for Root:PyPI. Multiple fixed versions available...

GX Group Earth 2022 ONT 安全漏洞

GX Group Earth 2022 ONT is an FTTH optical network terminal device developed by the Turkish company GX Group. There is a security vulnerability present in GX Group Earth 2022 ONT. This vulnerability stems from the web management interface transmitting user credentials via HTTP plaintext...

Froxlor 安全漏洞

Froxlor is a set of lightweight server management software developed by the Froxlor team. Versions of Froxlor prior to 2.3.7 contained security vulnerabilities. These vulnerabilities stemmed from the fact that the DomainZones.add API endpoint did not clean newline characters from TXT records,...

CVE-2025-67448

The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize user input in SMS messages before storing and displaying them. An attacker can send an SMS containing a malicious XSS payload, which will be executed in the...

GNCC GP5 信任管理问题漏洞

GNCC GP5 is a 2K indoor security camera produced by GNCC Corporation. The GNCC GP5 v7.1.76 version contains a security vulnerability. This vulnerability stems from the practice of storing sensitive wireless network information as plain text in the serial console during regular operations, which m...

CVE-2025-65640

Cross Site Scripting XSS vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to improper sanitization of user input in text fields when creating a new document. Specifically, when an authenticated attacker submits data containing JavaScript cod...

CVE-2025-65640

Cross Site Scripting XSS vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to improper sanitization of user input in text fields when creating a new document. Specifically, when an authenticated attacker submits data containing JavaScript cod...

Arket Globe Document Intelligence 跨站脚本漏洞

Arket Globe Document Intelligence is an enterprise document intelligence management platform developed by the Italian company Arket. Version 5.0.0.559 of Arket Globe Document Intelligence contains a security vulnerability. This vulnerability arises from improper handling of user input in text...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the DomainZones.add process. An attacker can inject arbitrary BIND directives or D...

GHSA-37M5-M4Q3-FC6X Froxlor: BIND Zone File Injection via TXT Record Content

Summary The DomainZones.add API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitra...

CVE-2026-36618

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version unbound 1.22.0, aiding targeted attacks against known vulnerabilities...

CVE-2026-45553

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructuredtext renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructuredtext, an attacker can use standard...

auto-obsidian (>=0.1.0, <=0.1.3), autogluon (0.5.3) +10 more potentially affected by CVE-2026-5241 via transformers (4.23.1)

transformers PYPI version 4.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - auto-obsidian =0.1.0, =0.5.3b20221025, =0.1.0, =0.0.8, =0.0.14 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...

data-generation-tool (>=1.0.1, <=1.1.1), openrlhf (>=0.4.0, <=0.4.2) +2 more potentially affected by CVE-2026-5241 via transformers (4.43.3)

transformers PYPI version 4.43.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - data-generation-tool =1.0.1, =0.4.0, =0.0.1, =0.1.1, =0.2.1 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...

allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2026-5241 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

ROOT-APP-PYPI-CVE-2025-6985 CVE-2025-6985 in rootio-langchain-text-splitters - Patched by Root

Root has patched CVE-2025-6985 in the rootio-langchain-text-splitters package for Root:PyPI. Multiple fixed versions available...

allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2026-5241 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

allennlp (>=2.5.0.dev20210603, <=2.5.1.dev20210621), allennlp-models (2.5.0) +22 more potentially affected by CVE-2026-5241 via transformers (4.6.1)

transformers PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.5.0.dev20210603, =0.0.10, =3.1.0, =2.0.0, =0.0.1, =0.0.1, =2.0.0a0, =0.9.0, =0.0.29, =0.16.0rc0, =1.0.5, =0.0.8, =0.0.9 and...

data-generation-tool (>=1.0.1, <=1.1.1), openrlhf (>=0.4.0, <=0.4.2) +2 more potentially affected by CVE-2026-5241 via transformers (4.43.3)

transformers PYPI version 4.43.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - data-generation-tool =1.0.1, =0.4.0, =0.0.1, =0.1.1, =0.2.1 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...