111917 matches found
EUVD-2026-57909
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-73340
The CVE covers a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Featured Image from URL , affecting versions
CVE-2026-67201
A flaw was found in V, specifically within its net.urllib and net.http components. This vulnerability allows a remote attacker to bypass host-based allowlists by exploiting a difference in how URLs are parsed. By crafting a malicious URL with a backslash, an attacker can trick the system into...
CVE-2026-73628
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...
CVE-2026-73622
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...
CVE-2026-73628
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...
UBUNTU-CVE-2026-73622
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...
CVE-2026-73628
The CVE-2026-73628 entry concerns Serendipity versions 2.3.5 through 2.6.0, which contain a reflected XSS in the search clean-URL route (/search/). In include/functions_routing.inc.php, the serveSearch() sanitisation sequence applies urldecode() after HTML-encoding, allowing a URL-encoded HTML pa...
EUVD-2026-57826
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...
fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency
A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators URLs, unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security...
fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency
A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators URLs, unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security...
JLSEC-2026-1275 libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2)...
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as...
Johnson Controls Metasys
ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and...
CVE-2026-0301
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability...
CVE-2026-0301
CVE-2026-0301 is an information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS , allowing an unauthenticated user with network access to obtain sensitive information. Panorama is explicitly not impacted. Affected versions are 10.2.x prior to 10.2.8 and 11.1.x p...
CVE-2026-0301 PAN-OS: Information Disclosure Vulnerability in URL Filtering
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability...
CVE-2026-0301 PAN-OS: Information Disclosure Vulnerability in URL Filtering
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability...
EUVD-2026-57714
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability...
CVE-2026-0301
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability...
PT-2026-71879
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...