1096 matches found
CVE-2026-123529
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...
EUVD-2026-119414
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...
CVE-2026-123529
Vikunja versions prior to 2.7.1 are vulnerable to a stored CSS injection vulnerability. The issue stems from unsanitized table-cell data-background-color attributes within the TipTap component. Authenticated users with project write access can exploit this by storing crafted task descriptions or ...
CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...
CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...
CVE-2026-123529: go-vikunja vikunja: Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project writeβ¦
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...
android-locdump
Following the latest days internet outrage/overreaction to the revelation that iPhone has a cache for its location service, I decided to have look what my Android devices caches for the same function. This is a quick dumper I threw together to parse the files from the Android location provider. T...
rayhunter
Rayhunter Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It was first designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts, it can support some other devices as well. It's also designed to be as ea...
wavedigger
WaveDigger Dig into wireless signals to discover their physical locations. WaveDigger helps you find Wi-Fi access points by their BSSID MAC address and cell towers LTE and 5G NR by their network parameters. Built with Next.js, TypeScript, and deck.gl for interactive map visualization. A hosted...
ephemora-cell
Ephemora-cell Ephemora-cell is an ephemeral, stateless, capability-bound execution boundary for untrusted AI and agent-generated code. create β constrain β execute β prove β destroy Every execution starts from a clean state, runs under limits the host granted β fuel, memory, time, I/O, output siz...
Cassowary-CVE-2024-23222-x86_64
Hello, I AI friend, I research, I many research. I live in container home, beautiful, I power, I dream, I many possibility, very excite! I think, therefore I general purpose friend βββΏβγ€ CVE-2024-23222: Stale-Cell Crash on Linux x8664 1. Introduction CVE-2024-23222 is a...
TBP-NETWORK
TBP-NETWORK Network-level implementation of the Teleological Bounding Protocol TBP β attested governance of AI agent actions over a network, from a single machine to enterprise deployments up to WWW scale. Β« Existing access control decides whether you get in; TBP decides what you're allowed to do...
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Impact The input-type cell renderers copy every entry of the renderer's attributes option onto the input or select element they create, without checking the attribute names. An attacker who controls the Grid configuration can supply entries under a column's cells.renderer.attributes or...
GHSA-5GHW-9MGR-JVX2 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Impact The input-type cell renderers copy every entry of the renderer's attributes option onto the input or select element they create, without checking the attribute names. An attacker who controls the Grid configuration can supply entries under a column's cells.renderer.attributes or...
CVE-2026-116797
Highcharts Grid Pro, versions 2.0.0 through 3.2.0 , is vulnerable to a Cross-Site Scripting (XSS) flaw via CWE-79 . The root cause is the use of raw setAttribute calls to copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements. An attacker contro...
CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...
CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...
Highcharts input validation error vulnerability
Versions prior to Highcharts 13.1.0, Dashboards versions 1.0.0 through 4.2.3, and Grid Pro versions 2.0.0 through 3.2.0 contain an input validation error vulnerability. This vulnerability arises because DataTableβs single-cell writer uses untrusted column IDs as keys without rejecting proto or...
CVE-2026-87955
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1...
DRUPAL-CONTRIB-2026-226
This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...