Prototype Pollution

Overview org.webjars.npm:csv-parse is a parser converting CSV text input into arrays or objects. Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj'proto' when a header contains duplicate proto entries, triggerin...

EUVD-2026-42050

Phoenix: Presence keys colliding with Object.prototype members break existence checks...

CVE-2026-85046

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=542403045...

EUVD-2026-57321

Material for MkDocs: DOM XSS in search suggestions via query parameter...

GHSA-XVG9-69GF-FJRF Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

EUVD-2026-62604

Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli...

SUSE CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-85230

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-56128

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CVE-2026-56126

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

CVE-2026-56127

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

CVE-2026-84649

A flaw was found in Stapler, a web framework used by Jenkins. An HTTP endpoint that serves dynamically generated JavaScript resources inadvertently embeds a user's cross-site request forgery CSRF token, also known as a crumb, as plain text. This allows a remote attacker, who controls a web page o...

CVE-2026-85230

CVE-2026-85230 is a persistent unsafe URL injection vulnerability in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only at render time, not when saved, allowing an authenticated user to persist arbitrary URLs—including javascript: scheme values—through either...

CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

EUVD-2026-70503

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-56128

pfSense Plus before 26.07 and pfSense CE before 2.9.0 contain a stored cross-site scripting vulnerability in the firewall schedule editor. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The v...

CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...