31402 matches found
EUVD-2026-41954
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...
GHSA-V5WF-J8J4-77H7
creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:44+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgei5er2s...
GHSA-9G22-W2GR-VCMP
creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:42+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgcfkjb2s...
CVE-2026-53759
creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:27+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4...
CVE-2026-55426
creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:11+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j...
CVE-2026-55501
creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:05+00:00| published-proof-of-concept| https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7 2026-07-10 16:21:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqckkdhmae2e 2026-07-10 22:20:14+00:00|...
CVE-2026-59710
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...
Cross-site Scripting (XSS)
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CraftSupportWidget.js process. An attacker can execute arbitrary JavaScript code in the admin's control panel session by crafting a malicious GitHub issue tit...
GHSA-24X4-J6X9-RFW5 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Summary An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session...
EUVD-2026-41209
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget...
CVE-2026-59710
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...
CVE-2026-55786
creationtimestamp| type| source ---|---|--- 2026-07-06 18:35:06+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85...
GHSA-7JVP-HJ45-2F2M
creationtimestamp| type| source ---|---|--- 2026-07-06 17:41:59+00:00| seen| https://gist.github.com/alon710/3392c028816ef9767631ce548afd9d91...
CVE-2026-48995
A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to serve malicious software packages if the codeload.github.com server is compromised or a user's machine configuration is tampered with. The issue arises because pnpm does not verify the integrity of...
PYSEC-2026-952 Incomplete validation in signal ops leads to crashes in TensorFlow
Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...
GHSA-J687-52P2-XCFF
creationtimestamp| type| source ---|---|--- 2026-07-05 13:35:36+00:00| seen| https://gist.github.com/konard/88609dd395d6031e4d410d3826dc1450...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the LFS object reuse process. An attacker can gain unauthorized access to private source objects by leveraging repository access without having the required Code-unit permissions...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass via the CODEOWNERS pattern matching process. An attacker can cause excessive resource consumption by submitting specially crafted patterns, potentially leading to service unavailability. Remediation Upgrade...