73027 matches found
Mozilla Firefox < 155.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 155.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-82 advisory. - Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firef...
Linux Distros Unpatched Vulnerability : CVE-2026-83615
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...
Divi < 4.27.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
Description The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being...
CVE-2026-84367: Improperly Controlled Modification of Object Prototype Attributes
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...
CVE-2026-84364: Uncontrolled Resource Consumption
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...
CVE-2026-84118: Use After Free
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...
CVE-2026-81887
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString and insertDotNotatedValueIntoData, accepts the proto, constructor, and prototype path segments and creates inherit...
Exploit for Cross-site Scripting in Interzen Zencrm
ZenShare Suite - Vulnerability Disclosure This repository con...
Exploit for Cross-site Scripting in Interzen Zenshare_Suite
ZenShare Suite - Vulnerability Disclosure This repository con...
Malicious code in mfafix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10490485dfd11cdb9eeb6e29b104c0d70651d1d8853a339a7420a75d09d066 lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the exported initMFA flow whic...
USN-8703-1: WebKitGTK vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...
EUVD-2026-68467
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...
CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
CVE-2026-82838
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82838 Default webserver configuration with incorrect CSP
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82838
Venueless 's default Docker image had a vulnerability where uploaded SVG files could be served with executable JavaScript content, potentially allowing stored XSS. The root cause was the absence of a proper Content Security Policy (CSP) in the image's default configuration. The fix sets a valid C...
CVE-2026-82838 Default webserver configuration with incorrect CSP
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
