5031 matches found
PT-2026-102697
Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description The link toolbar layout fails to properly escape inputs, creating a Cross-Site Scripting XSS vector. XSS is a flaw that allows an attacker to injec...
Exploit for CVE-2026-44011
CVE-2026-44011: Craft CMS authenticated RCE PoC This Python s...
RUSTSEC-2026-0311 Stack overflow on deeply nested LaTeX input
The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as \frac1…, braces, \sqrt…, \left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...
Stack overflow on deeply nested LaTeX input
The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as \frac1…, braces, \sqrt…, \left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...
PT-2026-107651
The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as frac1…, braces, sqrt…, left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...
plone-app-layout (>=4.0.0a1, <=4.0.0a4) potentially affected by CVE-2026-57149 via plone-app-portlets (5.0.2)
plone-app-portlets PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-layout =4.0.0a1, =4.0.0a4 Source cves: CVE-2026-57149 Source advisory: OSV:GHSA-RR49-F9G6-C9R5...
CVE-2026-91792
Foxit PDF Editor/Reader is vulnerable to a use-after-free condition when processing a specially crafted PDF. The vulnerability is triggered when the application performs reentrant zoom and layout operations through page- and annotation-related JavaScript actions, causing it to access page objects...
EUVD-2026-85130
When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...
MAL-2026-16520 Malicious code in @egencia/uitk-react-layout-flex (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @egencia/uitk-react-layout-flex (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...
UBUNTU-CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...
CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...
p5-Dancer2 -- Multiple vulnerabilities
Dancer project reports: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not...
PT-2026-96654
Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside...
CVE-2026-84126
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Layout: Grid component...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...