Inadequate Encryption Strength

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Inadequate Encryption Strength due to the use of weak cryptographic key generation in the createKeys function. An attacker can gain unauthorized access to protecte...

Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

Summary Kysely's DefaultQueryCompiler.sanitizeStringLiteral only escapes single quotes by doubling them ' → '' but does not escape backslashes. When used with the MySQL dialect where NOBACKSLASHESCAPES is OFF by default, an attacker can use a backslash to escape the trailing quote of a string...

GHSA-8CPQ-38P9-67GX Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

Summary Kysely's DefaultQueryCompiler.sanitizeStringLiteral only escapes single quotes by doubling them ' → '' but does not escape backslashes. When used with the MySQL dialect where NOBACKSLASHESCAPES is OFF by default, an attacker can use a backslash to escape the trailing quote of a string...

CVE-2026-4494

A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available a...

CVE-2026-4495

A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been release...

CVE-2026-4495

CVE-2026-4495 affects atjiu pybbs 6.0.0, specifically the create function in src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The issue enables cross‑site scripting via manipulation of the referenced component, with remote viability. Public exploit information is indicated in...

CVE-2026-33128

H3 is a minimal HTTP framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events SSE injection due to missing newline sanitization in formatEventStreamMessage and formatEventStreamComment. An attacker who controls any part of...

pybbs code injection vulnerability

pybbs is a Java-developed community platform created by iuiu’s individual developers. Version 6.0.0 of pybbs contains a code injection vulnerability. This vulnerability stems from a cross-site scripting attack in the create function located in the file...

CVE-2026-30580

The file manager application File Thingie version 2.5.7 is vulnerable to a Directory Traversal flaw. The root cause is the improper handling of the "create folder from url" functionality, which allows a malicious user to navigate outside the intended directory. This vulnerability can be leveraged...

PT-2026-26656

A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been release...

PT-2026-26762

Name of the Vulnerable Software and Affected Versions Kysely versions prior to 0.28.14 Description Kysely's DefaultQueryCompiler.sanitizeStringLiteral function inadequately escapes backslashes when handling string literals. Specifically, it only doubles single quotes but does not address...

CVE-2026-30580: Improper Limitation of a Pathname to a Restricted Directory

File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary files on the target system...

CVE-2026-32758 File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler http/resource.go. The destination path in resourcePatchHandler is...

CVE-2026-32758

The CVE-2026-32758 entry concerns File Browser, where versions 2.61.2 and earlier are vulnerable to Path Traversal via the resourcePatchHandler in http/resource.go. The flaw allows an authenticated user with Create or Rename permissions to bypass deny rules by injecting .. sequences in the destin...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-33397 via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-33397 Source advisory: OSV:GHSA-VFX2-HV2G-XJ5F...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory: SNYK:JS-ANGULARSSR-15701178...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-33397 via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-33397 Source advisory: GHSA-VFX2-HV2G-XJ5F...

Cross-site Scripting (XSS)

Overview @dicebear/initials is an Initials avatar style for DiceBear Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized interpolation of user-supplied options in the createAvatar function. An attacker can execute arbitrary scripts in the context of the...

PT-2026-26477

Name of the Vulnerable Software and Affected Versions DiceBear versions prior to 5.4.4 DiceBear versions 6.1.4 and earlier DiceBear versions 7.1.4 and earlier DiceBear versions 8.0.3 and earlier DiceBear versions 9.4.1 and earlier Description The software does not properly escape SVG attribute...

EUVD-2026-12854

In the Linux kernel, the following vulnerability has been resolved: xfs: check return value of xchkscrubcreatesubord Fix this function to return NULL instead of a mangled ENOMEM, then fix the callers to actually check for a null pointer and return ENOMEM. Most of the corrections here are for code...