692744 matches found
GHSA-HH8M-FM6V-7CVG Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...
CVE-2026-89086
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS 1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key...
CVE-2026-88061
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...
CVE-2026-88062
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...
CVE-2026-89011
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
CVE-2025-53640
CVE-2025-53640 – Authenticated User Enumeration in CERN's Indico BOLA Vulnerability PoC and technical analysis of CVE-2025-53640: a Broken Object Level Authorization BOLA vulnerability in Indico enables authenticated user enumeration via endpoint, exposing names, emails, and affiliations. Include...
CGA-RWG3-24FR-RHJF
Bulletin has no description...
CGA-2QFP-3V72-GFQ3
Bulletin has no description...
CGA-7G88-MF9G-J7H4
Bulletin has no description...
CGA-P675-X3WC-V3Q8
Bulletin has no description...
CGA-2XX5-7J63-VVXP
Bulletin has no description...
CGA-7649-6WPM-G4FV
Bulletin has no description...
CGA-3R86-VH4Q-5R3Q
Bulletin has no description...
CGA-X53H-JJMP-FXRQ
Bulletin has no description...
CGA-977M-2WQF-7CWV
Bulletin has no description...
CGA-MMWR-PX69-V87Q
Bulletin has no description...
CGA-66JJ-J47M-3HV3
Bulletin has no description...