USN-8756-1: Yelp vulnerability

It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information...

USN-8756-1 yelp vulnerability

It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports digital signatures for ODF documents and macros within documents. It provides visual aids to indicate that the document has not been altered since the last signature, and that the signature is valid. A vulnerability in certificate validation in LibreOffice allowed attackers t...

Astra Linux – Vulnerability in Firefox, Thunderbird

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized, resulting in a bypass that allowed device permissions to be leaked into untrusted sub-documents. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

Astra Linux – Vulnerability in cups

An authentication issue has been resolved through improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, and macOS Ventura 13.4. Unauthenticated users may be able to access recently printed documents...

Astra Linux – Vulnerability in pypdf2

pypdf is a pure-Python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who exploits this vulnerability can create a PDF that results in unexpected long execution times. This quadratic execution time blocks the current process and can even...

Astra Linux – Vulnerability in dovecot

Dovecot has provided a script that can be used for attaching files during text conversion. However, this script handles zip-style attachments in a way that is unsafe. An attacker could use specially crafted OOXML documents to cause unintended files on the system to be indexed, thereby ending up i...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

PT-2026-91843

It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

EUVD-2023-60669

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2026-88027

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

CVE-2026-88027 Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

EUVD-2026-75641

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

CVE-2026-88027

CVE-2026-88027 affects the MongoDB integration for Laravel in its embedded-document relation handling . The root cause is a query-operator injection flaw: a caller-supplied embedded record identifier can be interpreted as a query condition rather than a literal identifier, due to improper neutral...

CVE-2026-88027 Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...