10076 matches found
GHSA-CWV4-H3J5-W3CF rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path
Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 Summary plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature. When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and U...
CVE-2026-55647 DataEase: authenticated stored XSS in the dashboard text components
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable...
CVE-2026-55647
DataEase (open source data visualization/analysis tool) contains an XSS flaw in dashboard text components. Before version 2.10.24, stored content rendered via Vue v-html without server-side sanitization, enabling an authenticated user who can edit dashboard component data to inject HTML with exec...
CVE-2026-48951
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
EUVD-2026-42063
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951 Joomla! Core - [20260705] - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951 Joomla! Core - [20260705] - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
AIOHTTP vulnerable to brute-force leak of internal static file path components
SummaryPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain theexistence of absolute path components. ImpactIf an application uses web.static not recommended for production deployments, it may be possible for an attacker to ascertain t...
GO-2026-5874 Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet
Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet...
PYSEC-2026-1523 Langflow vulnerable to remote code execution
langflow =1.0.18 is vulnerable to Remote Code Execution RCE as any component provided the code functionality and the components run on the local machine rather than in a sandbox...
Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
ImpactHaystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions.Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. PatchesThe problem has been fixed...
PYSEC-2026-2068 Improper line feed handling in zenml
A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...
Malicious code in paypal-legal-components (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7337 Malicious code in paypal-legal-components (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @trp-ii-ii-component-library/ii-components (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7098 Malicious code in @trp-ii-ii-component-library/ii-components (npm)
--- -= Per source details. Do not edit below this line.=-...