EUVD-2026-114904

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

CVE-2026-83559

Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtilsescapeQuotes replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a...

CVE-2026-111089

Apache Wicket versions 8.0.0 through 8.19.0 , 9.0.0 through 9.24.0 , and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is the framework's failure to escape resource bundle texts (such as localized labels or CSS class names) when they are written into generat...

CVE-2026-83559

The Apache Wicket framework is vulnerable to an improper encoding issue in org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes(). The method fails to escape backslashes before escaping quotes, allowing an attacker to break out of a JavaScript string literal if they can influence the i...

CVE-2026-52887-NocoBase-SQLi-RCE

CVE-2026-52887 — NocoBase SQL Injection → PostgreSQL-superuser RCE SQL injection in the myInAppChannels:list action of NocoBase's @nocobase/plugin-notification-in-app-message ≤ 2.0.60. The filterlatestMsgReceiveTimestamp$lt request parameter is interpolated directly into a raw Sequelize.literal S...

CVE-2026-119717 pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...

CVE-2026-119717 pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...

BIT-NODE-MIN-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

PT-2026-132444

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

CLEANSTART-2026-GW52449 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

SUSE CVE-2026-115700

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-116678

The Vaultwarden Bitwarden-compatible server (prior to version 1.37.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its icon downloader. While the server validates initial host DNS results, it fails to apply the should_block_host() check to second-stage favicon URLs parsed from a...

CVE-2026-116678 Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

CVE-2026-116678 Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

SUSE CVE-2026-115774

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...

CVE-2026-115700

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-115700

The benoitc hackney library (versions 4.0.1 to 4.8.x ) is vulnerable to Server-Side Request Forgery (SSRF) due to an Interpretation Conflict in hackney_url. Specifically, the hackney_url:normalize/2 function fails to block percent-encoded bracketed IPv6 literals (e.g., %5B%3A%3Affff%3A127%2E0%2E0...

CVE-2026-115700

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Summary Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not ...