160977 matches found
DEBIAN-CVE-2026-50142
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...
MINI-2WX9-7GXF-R5PM
Bulletin has no description...
MINI-FGCM-XW47-G9G5
Bulletin has no description...
CVE-2026-73866
...
CGA-JRMR-PVJW-RMXV
Bulletin has no description...
CGA-HQF4-H7M5-8G92
Bulletin has no description...
CGA-F38V-44CX-4892
Bulletin has no description...
MINI-8W8M-WH35-FFGQ
Bulletin has no description...
MINI-WQR5-GHX5-HJ7V
Bulletin has no description...
MINI-VG9F-88V6-GR7J
Bulletin has no description...
DEBIAN-CVE-2026-49452
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/init.py when presentationalhints=True. The background attribute is inserted into a background-image:url declaration and parsed b...
CVE-2026-57580
creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtestvtntk2j 2026-08-18 19:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtew6glcs32e...
CVE-2026-45117
creationtimestamp| type| source ---|---|--- 2026-08-18 18:09:29+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtess267kd2y 2026-08-18 18:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtest5id6p2p...
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...
CVE-2026-55839
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...
CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...
CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...
CVE-2026-55839
Kestra , an open-source event-driven orchestration platform, is vulnerable to stored cross-site scripting (XSS) in versions prior to 1.3.24 . The root cause is in the custom Markdown parser (ui/src/utils/markdown_plugins/link.ts), which renders parsed attributes from the [[link]] syntax directly ...
CVE-2026-55839
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...
EUVD-2026-60976
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...