CVE-2026-93759

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-84992

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-81180

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

CVE-2026-33625

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2025-66455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements...

EUVD-2026-83259

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

CVE-2026-93432 Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

CVE-2026-93432

A flaw in the Quarkus Qute template engine (io.quarkus.qute:quarkus-core) allows Cross-Site Scripting (XSS) and JSON Injection . When the {#eval} section helper processes a sub-template, it fails to propagate the parent template's content type, causing untrusted data to be emitted as raw, unescap...

CVE-2026-81180

SysReptor Professional (a pentest reporting platform) is vulnerable to authenticated remote code execution prior to version 2026.61 . Authenticated users can upload image files in formats that trigger Ghostscript during processing, allowing embedded PostScript to operate within the shared tempora...

EUVD-2026-83250

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

CVE-2026-68513

A flaw was found in PyOpenEXR, a component of OpenEXR. A heap buffer overflow can occur when processing a specially crafted EXR image file. This vulnerability is triggered by a channel-name key collision between literal and prefixed RGB channels, causing the software to write data beyond the...

CVE-2026-59184

A flaw was found in OpenEXR. A remote attacker could exploit this vulnerability by providing a specially crafted EXR image file with a nonzero dataWindow.min. This could cause the TypedFlatImageChannel::row function to return an invalid memory pointer, leading to out-of-bounds or use-after-free...

EUVD-2026-83214

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759

Mongoid , the Ruby ODM for MongoDB, is vulnerable to server-side JavaScript injection via its query builder. A string-typed query criterion is not neutralized before being passed to the database as a server-side JavaScript expression. An unauthenticated attacker who can influence a query argument...

Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-61552

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

NPM: md-editor-v3: XSS via fenced-code language rendering bypass

NPM: md-editor-v3: XSS via fenced-code language rendering bypass vulnerability discovered by ? in WordPress Npm md-editor-v3 versions = 6.5.3...

GHSA-3RM2-H79C-8QW6 md-editor-v3: XSS via fenced-code language rendering bypass

Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...

md-editor-v3: XSS via fenced-code language rendering bypass

Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...