2673 matches found
PT-2026-42201
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Prototype pollution occurs within the CSV parsing logic during the import process. This issue allows untrusted file paths to be passed to the shell.openExternal...
Dify: When Your AI Platform Becomes the Attack Surface
Executive Summary We identified a couple of vulnerabilities in AI automation platform Dify resulting in cross-tenant sensitive information disclosure and one-click account takeover. These findings reinforce the pattern we documented in our previous n8n blogpost: even though AI automation platform...
Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
...
CVE-2026-45035 Tabby: RCE via `tabby://run` URL Scheme
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or...
CVE-2026-45035 Tabby: RCE via `tabby://run` URL Scheme
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or...
EUVD-2026-30568
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or...
OESA-2026-2305 python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box. Security Fixes: Pallets Click, versions 8.3.2 an...
OESA-2026-2304 python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box. Security Fixes: Pallets Click, versions 8.3.2 an...
OESA-2026-2303 python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box. Security Fixes: Pallets Click, versions 8.3.2 an...
OESA-2026-2302 python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box. Security Fixes: Pallets Click, versions 8.3.2 an...
BIT-JUPYTERLAB-2026-42557 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all cli...
EUVD-2026-30231
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-site scripting via the menuhoverclick parameter of the Navigation Menu Lite widget in all versions up to, and including, 6.4.11 due to...
python311-click-8.3.3-2.1 on GA media (moderate)
python311-click-8.3.3-2.1 on GA media Announcement ID: openSUSE-SU-2026:10760-1 Rating: moderate Cross-References: CVE-2026-7246 CVSS scores: CVE-2026-7246 SUSE : 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2026-7246 SUSE : 5.4...
WordPress plugin The Plus Addons for Elementor 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
Fedora 43 : python-click (2026-599dafe4ae)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-599dafe4ae advisory. Security fix for CVE-2026-7246 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
Security Updates for Microsoft Office Products C2R (May 2026)
The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. CVE-2026-40358 - Heap-based buffer overflow in Microsoft Office allows an unauthorized...
EUVD-2025-209830
The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a reflected cross site scripting XSS attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is...
CVE-2026-40420
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally...