FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 リフレクテッド SVG XSS FuguHub における SVG レンダリングを介したリフレクテッドクロスサイトスクリプティング XSS https://vulners.com/cve/CVE-2025-65790 このリポジトリは、FuguHub 8.1 におけるリフレクテッドクロスサイトスクリプティング XSS の脆弱性を文書化しています。この脆弱性では、内部ファイルマネージャー /fs/ インターフェースを介して SVG ファイルを表示すると、インライン JavaScript を含む SVG ファイルが実行されます。...

cve-lite-on-pi

cve-lite-on-pi CVE Lite CLI を pi モノレポに対して実行し、その結果をまとめた短いレポートです。 背景 この実験は、記事 "OWASP CVE Lite CLI – New Tool to Scan for Vulnerabilities in Your Projects" CyberSecurityNews に触発されて行われました。 CVE Lite CLI とは？ CVE Lite CLI は、JavaScript/TypeScript プロジェクト向けの、開発者に優しい ローカル...

CVE-2026-11744 PaperCut Hive Embedded App for Ricoh: Javascript injection

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...

CVE-2026-11744

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices . The application fails to properly sanitize input received during the NFC card reading process before passing it to the web view interface. A local attacker with physical access and a specially c...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

CVE-2026-88388

Espruino 2v29 commit bffc6d0 contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker, which passes the address of a 4-byte...

CVE-2024-42009

CVE-2024-42009 – Roundcube 保存型XSS Docker PoC 📌 概要 このリポジトリは、Roundcube Webmail の CVE-2024-42009 （保存型クロスサイトスクリプティング（XSS）の脆弱性）に対する実証コード（PoC）を示しています。 この脆弱性は、不適切なHTMLサニタイズとその後の安全でない属性の再処理に起因し、攻撃者が細工したHTMLメールを介して悪意のあるイベントハンドラを注入することを可能にします。 ⚠️ 影響を受けるバージョン Roundcube ≤ 1.5.7 Roundcube ≤ 1.6.7 🧠 脆弱性の概要...

CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day

XSS 0-Click / 0-Day 漏洞报告 跨站脚本（0-Click）导致 Pocket Android 与 iOS 中的 JavaScript 桥接滥用 — CVSS 9.2 严重 CVE-2026-82090 — 由 MITRE Corporation 发布（2026-08-28） 作者： Ing. Zampier Zago FUNFACTOR1 部门： 第 1 分部 — 网络安全部，PS 1978 Limited 联系方式： [email protected] 网站： www.ps1978ltd.it 分类： 安全漏洞分析 — CVE-2026-82090...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2025-55182

CVE-2025-55182 React JavaScript フレームワークにおける RCE 脆弱性に対するホストベースの検出ルール。...

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-84683 Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

EUVD-2026-85571

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-96759

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called...

CVE-2026-96757

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...

CVE-2026-96754

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...

CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...