75788 matches found
Joyland AI multiple vulnerabilities
RISK EVALUATION Joyland AI app contains multiple vulnerabilities. In the worst case, an attacker on the same network could intercept traffic and eventually execute arbitrary code, with access to the phone's camera, GPS, microphone, and filesystem. 2. RECOMMENDED PRACTICES No fix available. 3...
GHSA-6966-VJJ6-99XV JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...
CVE-2026-67104
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...
CVE-2026-67104 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...
EUVD-2026-90877
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...
CVE-2026-67104 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...
CVE-2026-67104
The HCL BigFix Service Management platform is affected by an Information Disclosure vulnerability. This flaw allows an unauthenticated attacker to analyze publicly accessible JavaScript files , which may facilitate the discovery of hidden administrative API endpoints for subsequent targeted explo...
CLSA-2026-1790854792 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 7.1.1-tuxcare.1...
CVE-2026-103249
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor...
CVE-2026-103249
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor...
CVE-2026-7176
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7175
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
EUVD-2026-90746
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7176
The Entradium platform by Crocantickets is vulnerable to a JavaScript injection flaw. Specifically, the Help text and Title parameters in the /events/-/custom_form/edit endpoint lack proper sanitization during the creation or modification of ticket sale forms. This allows an attacker to inject ma...
CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175
The Entradium platform by Crocantickets is vulnerable to a script injection flaw in the My Profile section. Specifically, the Business Name parameter within the /promoters/edit endpoint fails to properly sanitize input, allowing for the injection of JavaScript code . This malicious script can exe...
BIT-DISCOURSE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...