CVE-2026-91942

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

CVE-2026-55770

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

CVE-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

EUVD-2026-78667

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

CVE-2026-19407

CVE-2026-19407 affects the Google Cloud Gemini Enterprise Agent Platform SDK for Python in versions prior to 1.166.1 . The vulnerability is a GCS Bucket Squatting flaw that allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft without requiring prior privileges ...

CVE-2026-91983

Vikunja before 2.6.0 contains an API token scope bypass in its task read endpoints. The root cause is that authorization logic fails to inspect query string parameters , allowing attackers holding limited-scope tokens to leverage the expand parameter to access restricted data such as comments, re...

CVE-2026-91983

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-91981

Vikunja , a self-hosted task management application, is affected by a user enumeration vulnerability in versions before 2.6.0 . The root cause is improper validation of link-share tokens in the v2 API user search endpoints. An attacker holding a read-only share link can enumerate project members ...

CVE-2026-91981 Vikunja before 2.6.0 User Enumeration via v2 API

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint...

CVE-2026-91981 Vikunja before 2.6.0 User Enumeration via v2 API

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint...

CVE-2026-91953

FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the LBLOADBALANCEINFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an...

CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

EUVD-2026-78801

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-91942 crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

CVE-2026-91942 crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

EUVD-2026-78799

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

CVE-2026-91942 crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...