24132 matches found
Cross-site Scripting
DOMPurify is vulnerable to a Cross-site Scripting. The vulnerability is due to reliance on prototype-inherited properties during sanitization, where a prior prototype pollution can inject permissive tagNameCheck and attributeNameCheck logic, allowing malicious elements and attributes including...
Denial Of Service (DoS)
Tornado is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient string concatenation in the HTTPHeaders.add method when processing repeated HTTP headers, which allows an attacker to send a crafted request that blocks the server's event loop and exhausts CPU resources...
GHSA-VJGJ-42F6-7997
creationtimestamp| type| source ---|---|--- 2026-04-30 00:10:29+00:00| seen| https://gist.github.com/alon710/9ad465efb2dcc0bcfff6645d6617d88f...
CVE-2018-25314
creationtimestamp| type| source ---|---|--- 2026-04-29 20:25:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknwnpzlsb2o 2026-04-29 20:39:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknxfzyb4u2c...
CVE-2026-41960
creationtimestamp| type| source ---|---|--- 2026-04-29 18:40:55+00:00| seen| https://bsky.app/profile/ifin-intel.org/post/3mknqs2ra3n2q 2026-05-15 11:46:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvb34aetg2t...
CVE-2026-42644
creationtimestamp| type| source ---|---|--- 2026-04-29 14:46:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkndpdahgy2p...
CVE-2026-38945
creationtimestamp| type| source ---|---|--- 2026-04-29 09:00:04+00:00| seen| https://t.me/GithubRedTeam/82037...
Linux Distros Unpatched Vulnerability : CVE-2026-3298
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The method sockrecvfrominto of asyncio.ProacterEventLoop Windows only was missing a boundary check for the data buffer when using nbytes parameter. This allowed...
Security Bulletin: Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw
Summary A stored cross-site scripting XSS vulnerability in Langflow allows attackers to inject and execute arbitrary HTML/JavaScript through the Playground event-streaming and Markdown rendering pipeline due to unsafe use of rehypeRaw without sanitization, potentially leading to session theft,...
CVE-2026-4047
creationtimestamp| type| source ---|---|--- 2026-04-28 21:03:03+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mklibcksvu2g 2026-04-30 03:00:25+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mkompalp7h2d...
CVE-2026-39530
creationtimestamp| type| source ---|---|--- 2026-04-28 20:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mklglqji432g...
CVE-2026-42429
creationtimestamp| type| source ---|---|--- 2026-04-28 20:25:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mklg64g6io2q...
CVE-2026-7359
creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 01:10:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mklw3mprx52i 2026-04-29 03:57:11+00:00| seen|...
CVE-2026-5939
A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution...
EUVD-2026-26087
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted...
CVE-2026-41378
OpenClaw OpenClaw is affected up to version 2026.3.28. The vulnerability allows paired nodes with the role=node to dispatch node.event agent requests with unrestricted gateway-side tool access, enabling remote code execution on the gateway. The issue is fixed in 2026.3.31 (patched in OpenClaw as ...
CVE-2026-41378 OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted...
CVE-2026-41378
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted...
CVE-2026-41378 OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted...