CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661

The ApostropheCMS content management system is affected by a vulnerability in the sanitize-html library. Prior to version 2.18.0 , a non-default configuration allowing meta refresh elements could retain unsafe javascript: or data: URLs within the content attribute. This flaw can lead to unsafe sc...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

Buffer Under-read

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Buffer Under-read in the AJP process. An attacker can cause the response body to be split between requests, potentially leading to failure of subsequent requests...

Buffer Under-read

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Buffer Under-read in the AJP process. An attacker can cause the response body to be split between requests, potentially leading to...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via ownerisstale in src/filelock/soft.py and src/filelock/identity.py, when a process owner identity comparison is performed between a lock holder whose start token was recorded without a...

Use of Multiple Resources with Duplicate Identifier

Overview Affected versions of this package are vulnerable to Use of Multiple Resources with Duplicate Identifier via trybreakexpiredlock and trybreakstalelock in api.py and lease.py, where an attacker with write access to the lock directory can replace a held lock file with a symlink pointing at ...

CVE-2026-113612

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113606

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/...

CVE-2026-113607

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

CVE-2026-113596

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

Acronis Cyber Infrastructure Authorization Issue Vulnerability

Versions of Acronis Cyber Infrastructure prior to 6.0.1-112, 6.1.1-64, and 6.2.1-71 have vulnerabilities related to authorization checks. These vulnerabilities stem from improper authorization validation, which may lead to the exposure of sensitive information and data corruption...

Zephyr buffer error vulnerability

Versions of Zephyr 3.6.0 to 4.5.0 had a buffer error vulnerability. This vulnerability arises from the Nuvoton NPCX eSPI driver’s failure to validate the 12-bit length field when parsing TAF requests. As a result, out-of-bounds writes occur, and adjacent SRAM data is leaked into the SPI flash. Th...

Data Intelligence Lab@HKU Vibe-Trading path traversal vulnerability

Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7 contain a path traversal vulnerability. This flaw stems from improper handling of paths in the LLM agent file reading tool; readdocument lacks proper sandbox checks, and the safeuserpath restriction can be bypassed. As a result,...

FreeRDP encryption issue vulnerability

Versions FreeRDP from 2.0.0 up to 3.32.0 contain an encryption vulnerability. This vulnerability arises because the proxy fails to properly validate certificates when a validation module is not configured. It accepts TLS certificates from untrusted sources. Network location attackers can intercep...

Splunk Enterprise input validation error vulnerability

Versions prior to Splunk Enterprise 10.4.4 10.4.x, prior to version 10.2.8 10.2.x, prior to version 10.0.11 10.0.x, and prior to version 9.4.16 9.4.x contain an input validation error vulnerability. This vulnerability stems from improper handling of input data...

Chris Trudesk configuration error vulnerability

Versions 1.2.11 and earlier of Chris Trudesk contain a configuration error vulnerability. This vulnerability arises because the debug route enabled when NODEENV is not set lacks authentication; as a result, unauthenticated attackers can remotely invoke /debug/populatedb to delete all groups, tags...

Data Intelligence Lab@HKU Vibe-Trading prompt injection vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is a prompt injection vulnerability. This occurs because the agent injects commands into documents or web pages; BashTool and BackgroundRunTool pass the commands generated by the model directly to subprocess.run execute...

Chris Trudesk input validation error vulnerability

Versions 1.2.11 and earlier of Chris Trudesk contain an input validation error vulnerability. This vulnerability stems from server-side JavaScript injection in the search parameter; authenticated users can inject code into MongoDB’s $where clause. By disabling regular expressions in GET...