EUVD-2025-211052

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70515

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70519

The device log component of Fanvil x7a firmware version 2.6.0.1182 is vulnerable to a cross-site scripting (XSS) flaw. The software fails to properly sanitize or encode reflected user-supplied data , allowing an attacker to inject HTML and execute malicious JavaScript on any browser rendering the...

PT-2026-107526

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2026-106374

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552832446...

CVE-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

EUVD-2026-94066

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-106550 CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

CVE-2026-106550 CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-106446

Handlebars versions 4.0.0 through 4.7.10 are vulnerable to JavaScript Injection due to AST Type Confusion in the compile() and precompile() functions. The root cause is that the compiler validates only a subset of AST values (PathExpression, NumberLiteral, and BooleanLiteral), allowing an attacke...

CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106445

The Handlebars template engine is vulnerable to JavaScript Injection in versions 4.0.0 through 4.7.10 . The root cause is an own property check bypass in the lookupProperty function, which returns Function.prototype.constructor before applying the prototype-access deny list. If an attacker can re...

CVE-2026-103667 Gitea container registry stored XSS through blob media type

Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...