Cross-site Scripting (XSS)

Overview com.vaadin:vaadin is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions,...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge helpers used for chart configuration and component i18n in I18nMixin. An attacker can write properties onto Object.prototype, making them visible on objects throughout the application, by supplying ...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge helpers used for chart configuration and component i18n in I18nMixin. An attacker can write properties onto Object.prototype, making them visible on objects throughout the application, by supplying ...

WordPress Visualizer plugin < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure vulnerability

Contributor+ Cross-User Chart Configuration Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Visualizer versions 4.0.7...

CVE-2026-19726 Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726

The Visualizer WordPress plugin before version 4.0.7 contains an incorrect authorization vulnerability. It fails to properly restrict access to chart configurations, enabling users with the Contributor role and above to view the full configuration of any chart on the site. This includes configura...

EUVD-2026-59919

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

PT-2026-73127

Name of the Vulnerable Software and Affected Versions Visualizer versions prior to 4.0.7 Description Insufficient authorization in the plugin allows users with the Contributor role and above to read the full configuration of any chart on the site. This includes charts that the interface normally...

EUVD-2026-37931

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user. The MARIADBREPLICATIONUSER and MARIADBREPLICATIONPASSWORD environment variables defaulted to monitor and monitor respectively. This user...

WS-2020-0121

highcharts before 8.1.1 is vulnerable to Cross-Site Scripting. An attacker can exacute arbitrary code from chart configuration string...

BIT-HELM-2025-55198 Helm May Panic Due To Incorrect YAML Content

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expect...

CVE-2022-27207

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

CVE-2022-27207

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

Stored XSS vulnerability in global-build-stats

global-build-stats 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission. As of publication of this advisory, there is...

PT-2022-18294 · Jenkins · Jenkins Global-Build-Stats Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins global-build-stats Plugin versions 1.5 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because multiple fields in the chart configuration on the 'Global Build Stats' page are...

CVE-2022-27207: Improper Neutralization of Input During Web Page Generation

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

Design/Logic Flaw

In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system...