118340 matches found
CVE-2026-105831: Improper Neutralization of Input During Web Page Generation
EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...
PT-2026-108654
Summary The local web-fetch tool web fetch tool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...
PT-2026-107990
EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...
EulerOS 2.0 SP15 : perl-HTML-Parser (EulerOS-SA-2026-4003)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities.x000D x000D The XS routine backing...
EulerOS 2.0 SP15 : perl-HTML-Parser (EulerOS-SA-2026-3937)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities.x000D x000D The XS routine backing...
Linux Distros Unpatched Vulnerability : CVE-2026-94488
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cp...
PT-2026-108677
Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...
PT-2026-108032
Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.6 Pydantic AI versions prior to 2.52.0 Description The local web fetch tool and the WebFetch local fallback can consume excessive CPU and memory during the conversion of HTML to Markdown. This occurs...
ssdlc-dast-poc
SSDLC DAST PoC Validar DAST em dois microserviços no playgrou...
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Summary When remote fetching is enabled enableremotefetch=True, together with fetchimages=True or HTML renderpage=True, docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request...
GHSA-PC36-QWJQ-X68C Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Summary When remote fetching is enabled enableremotefetch=True, together with fetchimages=True or HTML renderpage=True, docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request...
EUVD-2026-92810
Docling: Crafted DoclingDocument JSON embeds local image files into converted output...
EUVD-2026-92812
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion...
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Summary The HTML, JATS, ODS OpenDocument spreadsheet and BoxNote backends accept table rowspan / colspan values without an upper bound. A few bytes of input, such as , make docling run loops proportional to the declared span and allocate a table grid of the declared size. The result is CPU and...
Incomplete List of Disallowed Inputs
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the oEmbed service ghost/core/core/server/services/oembed/oembed-service.js when handling photo-type oEmbed responses from arbitrary, self-declared oEmbed endpoints...
EUVD-2026-92761
Ghost: Stored XSS via Bookmark Card Images...
GHSA-347Q-26QQ-H2P6 Ghost: Stored XSS via Bookmark Card Images
Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin...
Ghost: Stored XSS via Bookmark Card Images
Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin...
USN-8900-1: Go Networking vulnerabilities
It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. CVE-2022-27664 It was discovered that ...
USN-8900-1 golang-golang-x-net vulnerabilities
It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. CVE-2022-27664 It was discovered that ...