USN-8874-1: sg3_utils vulnerability

Shaomin Chen discovered that sg3utils did not properly sanitize device identification data. An attacker could possibly use this issue to execute arbitrary commands...

CVE-2021-43530-UXSS-On-QRcode-Reader-

CVE-2021-43530-QR码读取器上的UXSS- Firefox for Android中存在一个通用XSS漏洞，原因是处理从QR码扫描的URL时消毒不当。此漏洞仅影响Firefox for Android。其他操作系统不受影响。该漏洞影响Firefox 94。...

CVE-2021-22204

CVE-2021-22204 CVE摘要 在ExifTool 7.44及以上版本中，对DjVu文件格式中用户数据的清理不当，允许在解析恶意图像时执行任意代码。 受影响版本 版本 7.44 - 12.23 依赖项 依赖：djvulibre-bin exiftool 调用以下三个命令：bzz, djvumake, exiftool 参考资料 GitHub POC - Gustavo Dutra，2021年5月11日 案例研究：CVE-2021-22204 Exiftool RCE - Gustavo Dutra，2021年5月19日 CVE详情 - CVSS评分6.8...

CVE-2023-24278

CVE-2023-24278 - Squidex 中的反射型 XSS 漏洞 概述 CVE ID: CVE-2023-24278 受影响产品: Squidex 7.4.0 之前的所有版本 报告者: Ioannis Christodoulakos 本仓库提供了关于 Squidex 开源无头 CMS 软件中发现的两个反射型跨站脚本（XSS）漏洞的信息及利用方式。这些漏洞影响 7.4.0 之前的所有版本，攻击者可通过向 /squid.svg 端点的特定查询参数中注入代码，在受害者浏览器中执行恶意 JavaScript 代码。 漏洞详情 漏洞是由于 /squid.svg 端点的 text 和...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2022_5775)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225775 advisory. golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705...

Rocky Linux 9 [CIQ] Security Update: toolbox / toolbox-debuginfo / toolbox-debugsource / toolbox-tests Multiple Vulnerabilities (crlsa-2022_8098)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228098 advisory. golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: io/fs: stack exhaustion in Glob CVE-2022-30630 golang:...

Rocky Linux 8 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo Multiple Vulnerabilities (crlsa-2022_7648)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227648 advisory. golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: io/fs: stack exhaustion in Glob CVE-2022-30630 golang:...

CVE-2024-21534

CVE-2024-21534: Vulnerabilidad de Ejecución Remota de Código en jsonpath-plus =10.0.7 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para una vulnerabilidad crítica de Ejecución Remota de Código RCE en el paquete jsonpath-plus, que afecta a versiones anteriores a la 10.0.7...

AlmaLinux 9.2 [TuxCare] Security Update: containernetworking-plugins (ALMALINUX9.2:CLSA-2025:1762181347)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762181347 advisory. - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the...

CVE-2026-84739

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-93606

A flaw was found in vm2. An attacker running untrusted code within the sandbox can bypass isolation controls to achieve arbitrary code execution on the host system. This issue is caused by improper sanitization of host Promise objects, which allows sandboxed scripts to manipulate Promise...

PT-2026-98982

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

PT-2026-98979

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

PT-2026-97652

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description An issue exists in the Webform module, which is used to create forms and collect submissions. Due to improper sanitization of announcement text used for assistive technologies, specially craft...

CVE-2026-19619

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

EUVD-2026-80117

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-78252

GitLab CE/EE versions from 15.3 before 19.1.8 , 19.2 before 19.2.6 , and 19.3 before 19.3.2 are affected by improper sanitization of user-controlled data in the Markdown JSON table renderer . Under certain conditions, an authenticated user could induce a targeted user to perform unintended state-...

EUVD-2026-80222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

Astra Linux – Vulnerability in Yard

YARD is a Ruby documentation tool. The “frames.html” file within the Yard Doc’s generated documentation is vulnerable to Cross-Site Scripting XSS attacks due to inadequate sanitization of user input within the JavaScript segment of the “frames.erb” template file. This vulnerability has been fixed...