11155 matches found
CVE-2026-44727
A flaw was found in Jupyter Server. The nbconvert HTTP handlers in Jupyter Server render user-authored notebook HTML without a sandbox directive in their Content-Security-Policy. This, combined with nbconvert.HTMLExporter's default non-sanitizing behavior, allows a notebook containing an HTML...
H2O has an External Control of File Name or Path vulnerability
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the...
PYSEC-2026-353 H2O has an External Control of File Name or Path vulnerability
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the...
PYSEC-2026-350 External Control of File Name or Path in h2oai/h2o-3
Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting ...
PT-2026-53439
Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting ...
PT-2026-53442
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the...
Missing Authentication For Critical Function
Backpropagate is vulnerable to Missing Authentication for Critical Function. The vulnerability is due to the Reflex web UI failing to enforce the --auth authentication mechanism despite indicating it is enabled, which allows an attacker who can access the exposed UI port to perform unauthorized...
SUSE CVE-2026-6658
A vulnerability in jupyter/nbconvert versions tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export...
GHSA-H77M-QRJ7-JXCW Statamic Vulnerable to CSV formula injection in form submission exports
Impact Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character e.g. = , + , - , @ could be interpreted as a live formula when a Control Panel user opens the export in a...
Statamic Vulnerable to CSV formula injection in form submission exports
Impact Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character e.g. = , + , - , @ could be interpreted as a live formula when a Control Panel user opens the export in a...
CSV Injection
Overview Affected versions of this package are vulnerable to CSV Injection in the export process. An attacker can execute arbitrary spreadsheet formulas by submitting specially crafted form values that begin with formula trigger characters, which are then interpreted as live formulas when the...
CVE-2026-6658 Cross-site Scripting (XSS) in jupyter/nbconvert
A vulnerability in jupyter/nbconvert versions tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper sanitization of text/vnd.mermaid output during the HTML export process. An attacker can execute arbitrary JavaScript in the context of a user's browser by convincing a user to view a maliciously...
PT-2026-52688
Name of the Vulnerable Software and Affected Versions jupyter/nbconvert versions prior to 7.17.1 Description Cross-site Scripting XSS occurs during HTML exports due to unsanitized text/vnd.mermaid output. The data mermaid block in share/templates/lab/base.html.j2 renders this output directly into...
PT-2026-53028
Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.24 Statamic versions prior to 6.20.1 Description Form submission values in src/Forms/Exporters/CsvExporter.php are not neutralized for spreadsheet formula characters during CSV export. An unauthenticated front-e...
GO-2026-5429 SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869) in github.com/siyuan-note/siyuan/kernel
SiYuan: Path Traversal via Double URL Encoding in /export/ Endpoint Incomplete Fix Bypass for CVE-2026-30869 in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If th...
a3s-cron (0.1.2), a3s-lane (>=0.2.0, <=0.4.0) +178 more potentially affected by CVE-2026-48504 via opentelemetry_sdk (>=0.18.0, <=0.31.0)
opentelemetrysdk CARGO version =0.18.0, =0.2.0, =0.1.0, =0.0.1, =0.8.1, =0.3.0, =4.0.15, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-48504 Source advisory: OSV:GHSA-W9WP-H8WV-79JX...
GO-2026-5123 Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export in github.com/lin-snow/ech0
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
GO-2026-5112 Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server
Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
