2743 matches found
CVE-2026-81731
Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...
EUVD-2026-67236
Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...
CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...
CLSA-2026-1787226168 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.5-tuxcare.1...
CLSA-2026-1787224853 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.1-tuxcare.1...
CLSA-2026-1787224839 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.2-tuxcare.1...
CLSA-2026-1787224704 TuxCare security update for bootstrap (5 CVEs)
TuxCare rebuilt bootstrap to address 5 CVEs. Fixed in 3.0.0-tuxcare.1...
CVE-2026-61807
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...
CVE-2026-61807 Snipe-IT: Stored DOM XSS via table selected-count IDs
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...
CVE-2026-61807
Snipe-IT versions before 8.6.2 are vulnerable to stored DOM XSS: a crafted manufacturer/supplier name flows into data-selected-count-id in bootstrap-table.blade.php, is decoded client-side, and is injected via jQuery .after(), executing JS in authenticated users' sessions. Fix is version 8.6.2. N...
CVE-2026-61807: Improper Neutralization of Input During Web Page Generation
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...
Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-2055)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2055 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...
Important: javapackages-bootstrap
Issue Overview: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of heade...
CVE-2026-50524 vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
CVE-2026-50659 vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
CVE-2026-50651 vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
GHSA-74JP-VM22-8Q8X vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
GHSA-QVW7-JM5C-6HQW vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...