Jupyterlab Python Library < 4.5.7 (CVE-2026-42557)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The version of JupyterLab installed on the remote host is prior to 4.5.7. It is, therefore, affected by a vulnerability: - JupyterLab's command linker attributes in HTML...

Jupyter Notebook Python Library 7.0.0 < 7.5.6 (CVE-2026-42557)

Jupyter Notebook is an extensible environment for interactive and reproducible computing. The version of Jupyter Notebook installed on the remote host is 7.0.0 prior to 7.5.6. It is, therefore, affected by a vulnerability: - JupyterLab's command linker attributes in HTML enable one-click command...

CLSA-2026-1778140717 vim: Fix of 10 CVEs

CVE-2022-0158: fix Vim9 reading before start of line with single $ - CVE-2022-0696: fix crash when switching tabpage in cmdline window - CVE-2022-1674: fix crash when matching buffer with invalid pattern - CVE-2022-1725: fix using NULL regexp program in buffer matching - CVE-2022-1771: fix...

Exploit for Incorrect Implementation of Authentication Algorithm in Google Android

CVE-2026-0073 — Android ADB TLS Authentication Bypass A proof...

GHSA-MQCG-5X36-VFCG JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with ...

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with ...

WordPress Zingaya Click-to-Call plugin <= 1.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Julian Chibuike Nwadinobi Wackydawg - streamio in WordPress Plugin Zingaya Click-to-Call versions = 1.0...

PT-2026-38276

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 4.5.7 Jupyter Notebook versions prior to 7.5.6 Description The HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements. Because CommandLinker listens for all click events...

CVE-2026-6696 Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter

The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'firstname', 'lastname', and 'phone' parameters on the plugin's sign-up admin page in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output...

CVE-2026-6696

CVE-2026-6696 concerns the Zingaya Click-to-Call plugin for WordPress. The connected documents confirm a Reflected Cross-Site Scripting vulnerability on the plugin’s sign-up admin page, affecting all versions up to and including 1.0. The root cause is insufficient input sanitization and output es...

SUSE CVE-2026-7246

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account...

WordPress plugin Zingaya Click-to-Call 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

UBUNTU-CVE-2026-7246

Pallets Click, versions 8.3.2 and below, contain a command injection v...

Exploit for Use After Free in Microsoft

LetsDefend SOC336: Windows OLE Zero-Click RCE Exploitation Det...

CVE-2026-7246

A flaw was found in Pallets Click. This command injection vulnerability, located in the click.edit function, allows an attacker with an unprivileged account to execute arbitrary operating system OS commands. This could lead to unauthorized control over the affected system...

Linux Distros Unpatched Vulnerability : CVE-2026-7246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands...

PT-2026-39747

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-21 ImageMagick versions prior to 6.9.13-46 Description An overflow can be triggered when a user opens a malicious MIFF file in the display tool and right-clicks a tile to invoke the Load / Update menu item...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the filename parameter passed to editfiles function via click.edit. This function invokes a subprocess with shell=True that can be injected into by including double-quoted strings in a malicious filename. An attack...

5mghost-rover (>=0.0.1 <=0.0.3), a-mailx (=0.1.0) +1054 more potentially affected by CVE-2026-7246 via click (>=8.2.0 <=8.3.2)

click PYPI version =8.2.0, =0.0.1, =0.6.0, =0.4.0, =0.1.18, =0.1.0, =0.1.0, =0.0.2, =0.4.0, =1.403.3, =0.0.24, =0.9.10, =0.9.11 and more Source cves: CVE-2026-7246 Source advisory: SNYK:PYTHON-CLICK-16347201...

PYSEC-2026-2132

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account...