2391 matches found
Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2023_0089)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230089 advisory. libreoffice: Macro URL arbitrary script execution CVE-2022-3140 libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation...
Rocky Linux 9 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2023_0304)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230304 advisory. libreoffice: Macro URL arbitrary script execution CVE-2022-3140 libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation...
UBUNTU-CVE-2026-102581
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...
EUVD-2026-89720
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
EUVD-2026-89661
Cross-Site Scripting via Script Validation Bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...
PT-2026-103066
Name of the Vulnerable Software and Affected Versions baserCMS affected versions not specified Description A stored cross-site scripting issue exists where arbitrary scripts can be executed in a user's web browser. This occurs through the use of appended strings within email form fields...
Cross-site Scripting (XSS)
Overview @jupyterlab/apputils is a JupyterLab - Application Utilities Affected versions of this package are vulnerable to Cross-site Scripting XSS via the notebook paste action in packages/notebook/src/actions.tsx, which does not validate whether clipboard data originated from within the...
CVE-2026-100646: Origin Validation Error
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...
CVE-2026-95626
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...
EUVD-2026-85177
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...
CVE-2026-95626
The Tauri framework v2 contains a vulnerability where its Content Security Policy (CSP) hardening is ineffective against specific URI schemes. While Tauri injects a random nonce to restrict script execution, the CSP Level 3 specification allows data: and blob: schemes to remain active even when a...
CVE-2026-91798
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...
CVE-2026-91798 Foxit PDF Editor/Reader Updater Privilege Escalation
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...
CVE-2026-91798
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader . The flaw is caused by an insecure permission configuration that allows regular users to modify the configuration file. This vulnerability could lead to arbitrary script execution with higher privil...
CVE-2026-91798 Foxit PDF Editor/Reader Updater Privilege Escalation
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...
CVE-2026-95626: Improper Neutralization of Input During Web Page Generation
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...
CVE-2026-91798: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...
PT-2026-97261
Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description The Content Security Policy CSP hardening mechanism, which uses a random nonce to restrict script execution, is ineffective if the application includes data: or blob: in its script-src directiv...