161349 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-100310
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege check...
Debian dsa-6522 : exim4 - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6522 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6522-1 [email protected] https://www.debian.org/securit...
Malicious code in chai-as-relay (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...
MAL-2026-17189 Malicious code in chai-as-relay (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...
CVE-2026-100641
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100630
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...
CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
EUVD-2026-87735
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100641
SiYuan versions before v3.8.4 are vulnerable to a Stored XSS flaw because they fail to HTML-escape stored flashcard block content. Specifically, content retrieved from the /api/riff/getRiffCards endpoint is inserted into app/src/card/viewCards.ts and assigned to listElement.innerHTML without prop...
CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...
EUVD-2026-87724
AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...
CVE-2026-100630
AVideo contains a stored cross-site scripting (XSS) vulnerability within the video trailer1 field . The issue arises because this field is rendered unsanitized inside an inline onclick JavaScript string . Attackers who possess video upload permissions can inject HTML entity-encoded payloads that ...
Astra Linux – Vulnerability in Chromium
The use of after-free in Views in Google Chrome before version 152.0.7977.65 allowed a remote attacker to leverage social engineering to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in V8 in Google Chrome before version 153.0.8010.36 allowed a remote attacker to leverage social engineering to execute arbitrary code within the sandbox through a crafted Chrome extension. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
In V8 of Google Chrome, before version 152.0.7977.75, an uninitialized resource allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Missing authorization in the FileSystem in Google Chrome prior to version 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and utilized social engineering to potentially execute arbitrary code outside the sandbox, through a crafted HTML page. Chromium security...
Astra Linux – Vulnerability in Chromium
The use of after-free in Views in Google Chrome before version 152.0.7977.65 allowed a remote attacker to leverage social engineering to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Medium...