65737 matches found
Cross-site Scripting (XSS)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the missing MIME-type validation of profileimageurl field. An attacker can execute arbitrary HTML or JavaScript in the context of user's browser by injecting malicious HTML or...
GHSA-7RX4-C5VX-G8W3
creationtimestamp| type| source ---|---|--- 2026-05-14 18:40:28+00:00| seen| https://gist.github.com/alon710/260608e1e5e80ae5e3b0acd83fc48ee1...
Improper Encoding or Escaping of Output
Overview launder is an A sanitize module for the people. Built for ApostropheCMS. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the linkHref field handling. An attacker can execute arbitrary JavaScript by supplying a javascript: URL in an image...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the linkHref field handling. An attacker can execute arbitrary JavaScript by supplying a javascript: URL in an image widget's link URL field and having it rendered on the page. This affects...
CVE-2026-8584
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:56:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltsqdeozq2e 2026-05-17 18:00:00+00:00| seen|...
CVE-2026-8586
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:53:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltsjmeefy2e 2026-05-17 18:00:00+00:00| seen|...
CVE-2026-8581
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:43:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltrzb4rhk2e 2026-05-17 18:00:00+00:00| seen|...
CVE-2026-8580
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:41:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltrur5oyb2i 2026-05-15 01:30:26+00:00| seen|...
CVE-2026-8583
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:46:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlts673t6w2o...
CVE-2026-8574
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:31:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltrcj6i2q2k...
CVE-2026-8587
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 22:01:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltsxz465x2o 2026-05-17 18:00:00+00:00| seen|...
CVE-2026-40701
creationtimestamp| type| source ---|---|--- 2026-05-14 17:00:08+00:00| seen| https://t.me/truesecator/8204 2026-05-18 05:12:49+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mm44hn2v5cs2 2026-05-19 08:05:32+00:00| seen|...
EUVD-2026-30333
Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feeds by providing a feed URL via the web interface or the API. In affected versions, an authenticated attacker could provide a URL pointing to internal/private IP ranges or...
CVE-2026-42590 Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix...
CVE-2025-62619
Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potentially leading to loss of confidentiality...
EUVD-2025-209845
Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potentially leading to loss of confidentiality...
EUVD-2025-209847
Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arbitrary code execution...
CVE-2026-6504
creationtimestamp| type| source ---|---|--- 2026-05-14 13:48:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlsxgcb7c62p...