73673 matches found
CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...
CVE-2026-71502
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...
EUVD-2026-54251
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...
Use of Blocking Code in Single-threaded, Non-blocking Context
Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Use of Blocking Code in Single-threaded, Non-blocking Context via the ticks parameter in radar diagrams. An attacker can cause...
Prototype Pollution
Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution in the assignWithDepth process used by configuration APIs. An attacker can modify internal object properties b...
@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.35), @142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25) +223 more potentially affected by CVE-2026-50159 via mermaid (>=11.0.0, <=11.16.0)
mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.0, =1.1.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.7.9, =0.15.0, =0.25.2 - @changmao/reveal-md 6.1.4-chanmao0.0 and more Source cves: CVE-2026-50159 Source advisory: OSV:GHSA-6X64-9X62-F2GX...
Improperly Controlled Sequential Memory Allocation
Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the setXAxisRangeData function when configuring an X-Axis wi...
EUVD-2026-54241
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...
CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework
AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...
CVE-2026-71447
AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...
CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework
AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...
CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View
AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...
CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View
AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...
CVE-2026-71446
AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...
CVE-2026-71445
AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...
CVE-2026-71445
AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...
CVE-2026-66843
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
CVE-2026-66683
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
EUVD-2026-54082
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...