20686 matches found
GHSA-HQVF-45JJ-MCCQ vulnerabilities
Vulnerabilities for packages: localstack...
NocoBase - VM Sandbox Escape to Remote Code Execution
NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...
WordPress Tutor LMS <2.0.10 - Cross Site Scripting
WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...
ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...
CVE-2026-54526 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines...
CVE-2026-73569 vulnerabilities
Vulnerabilities for packages: tileserver-gl, jitsucom-jitsu...
CVE-2026-73506
A flaw was found in Oh My Posh, a customizable terminal prompt renderer. The software failed to properly sanitize attacker-controlled data, such as current directory names and Git metadata, before displaying it in the terminal. This oversight allows for terminal escape sequence injection, enablin...
CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...
CVE-2026-73480
A flaw was found in gdu, a disk usage analyzer. This vulnerability occurs because gdu does not properly remove terminal escape sequences from directory and file names when displaying paths after exiting its Text-based User Interface TUI. An attacker can craft malicious directory or file names...
CVE-2026-56859 vulnerabilities
Vulnerabilities for packages: sonobuoy, crossplane-provider-aws-securityhub, hubble-fips, azurefile-csi, kapp-controller-fips, nodetaint-fips, rancher-system-agent, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, plutono, cluster-api,...
GO-2026-5450 vulnerabilities
Vulnerabilities for packages: virt-handler-fips, virt-controller, virt-launcher, virt-controller-fips, virt-operator, virt-handler, virt-api, virt-operator-fips, virt-api-fips...
GO-2024-3299 vulnerabilities
Vulnerabilities for packages: traefik...
GO-2021-0066 vulnerabilities
Vulnerabilities for packages: spark-operator...
GO-2024-3042 vulnerabilities
Vulnerabilities for packages: podman...
GO-2024-3281 vulnerabilities
Vulnerabilities for packages: rancher-agent...
GO-2025-3992 vulnerabilities
Vulnerabilities for packages: nvidia-container-toolkit...
GO-2025-4034 vulnerabilities
Vulnerabilities for packages: minio...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...