CVE-2026-96755

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96754

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-25860

CVE-2026-25860 OpenClinic GA 5.247.01 の DICOM 画像アップロードハンドラを介した反射型 XSS この XSS を RCE に連鎖させたい場合は、以下を参照してください: https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce 説明 OpenClinic GA = v5.351.19 12/05/2026 には、DICOM 画像アップロードハンドラに反射型クロスサイトスクリプティングの脆弱性が存在し、攻撃者が DICOM...

CVE-2026-54355

A flaw was found in MapServer, a system for developing web-based GIS applications. This reflected Cross-Site Scripting XSS vulnerability occurs in the OpenLayers HTML output when the HTTPXFORWARDEDHOST value is not properly escaped. An unauthenticated attacker can craft a malicious URL that, when...

CVE-2026-91817

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash...

CVE-2026-91818

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-91816

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and applicati...

CVE-2026-91806

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...

CVE-2026-91792

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...

CVE-2026-91799

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution...

CVE-2026-91788

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it...

CVE-2026-91791

When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in ...

CVE-2026-50228

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — タイルHTMLフィールドを介したStored XSS（PoC） このリポジトリは、URVE Smart Office のiOSモバイルアプリケーション に影響を与えるStored Cross-Site Scripting（XSS）脆弱性 の概念実証（PoC） を文書化しています。 入力バリデーションの不備により、攻撃者が制御可能なJavaScriptがタイルのHTMLフィールド に注入される可能性があります。ペイロードは保存され、後に影響を受けるコンテンツがモバイルクライアントに配信されiOS端末上でレンダリングされる際に実行されます。 ⚠️...

CVE-2026-91788

Foxit PDF Editor/Reader is vulnerable to an information disclosure flaw because the JavaScript interface fails to perform the required attribute authorization checks . This oversight allows a trusted malicious PDF to potentially access sensitive content from other documents residing within the sa...

EUVD-2026-85133

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it...

EUVD-2026-85131

When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in ...

EUVD-2026-85130

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...

EUVD-2026-85124

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution...