605 matches found
CVE-2026-82381
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...
CVE-2026-82381 Apache Roller: Stored cross-site scripting in the authoring UI
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...
CVE-2026-82381
Apache Roller version 6.1.5 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. An attacker with authoring rights on a weblog can store crafted content that is injected into the authoring UI's JavaScript string literals and...
EUVD-2026-88140
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...
CVE-2026-82381 Apache Roller: Stored cross-site scripting in the authoring UI
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...
CVE-2026-82381: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...
Emojify
Emojify ๐โ๐๐ โ ๐ต ๐ต ๐ ๐ก ๐ฅ ๐ ๐ข๐น๐น ๐ฌ ๐ฝ ๐ ๐๐จ ๐๐ ๐ ๐ญ ๐ผ ๐ ๐ ๐ฌ๐ฝ โ๐ท๐ ๐ต ๐ฌ ๐ต โฝ ๐ฑ ๐ฅ ๐ ๐ข๐น๐น ๐ฉ ๐ ๐ ๐ ๐ฑ โฝ ๐ผ ๐ ๐ ๐ โ ๐ต ๐ต ๐ญ ๐ช ๐ ๐ฅ ๐ ๐ข ๐ ๐โ๐๐ ๐ ๐ ๐ช๐ ๐ฝ๐ผ๐ผ ๐ ๐ ๐ฉ ๅฐๅญ็ฌฆๅๅญ็ฌฆไธฒๆๅญๆททๆทไธบ่กจๆ ็ฌฆๅท๏ผๅนถ้ๆบๅ็ฑปใๆฅๅฃใๆนๆณๅๅ้ๅใ ๆณจๆ ็ปงๆฟใ้ๅๅๅฎ็ฐ๏ผๆฅๅฃๆนๆณ๏ผ็ๆนๆณๅจๆททๆท่ฟ็จไธญไผ่ขซ่ทณ่ฟใ ็จๆณ git clone https://github.com/Tomiwa-Ot/Emojify.git cd Emojify/ dotnet publish -c Release...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results โ the output of agent reconnaissance against target services โ into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results โ the output of agent reconnaissance against target services โ into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...
CVE-2026-61732
Versions prior to 1.1.17 of Decepticon , an autonomous hacking agent, are vulnerable to a role-boundary forgery because they fail to neutralize ChatML special-token literals when wrapping web crawl results into LLM messages. When using the BYOK deployment model with common providers (such as vLLM...
CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results โ the output of agent reconnaissance against target services โ into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...
CVE-2026-61732: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results โ the output of agent reconnaissance against target services โ into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...
USN-8808-1: SQL parse vulnerabilities
It was discovered that SQL parse contained multiple algorithmic complexity flaws when parsing SQL statements with deeply nested parentheses, comments, or dollar-quoted string literals. An attacker could use this issue to cause SQL parse to consume excessive CPU resources, resulting in a denial of...
CVE-2026-96755
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...
CVE-2026-96758
The orval @orval/core package, prior to version 8.28.0 , is vulnerable to a code injection flaw in its form-data serializer . The root cause is a failure to escape multipart property names within generated template literals. This allows an attacker to inject ${...} expressions into OpenAPI schema...
CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...
CVE-2026-96755
Versions 8.14.0 through 8.28.1 of orval are vulnerable to a code injection vulnerability within the @orval/effect generator. The root cause is the improper conversion of OpenAPI schema defaults into template literals . An attacker can inject arbitrary JavaScript expressions by including ${...} sy...
CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...
CVE-2026-96755: Improper Control of Generation of Code
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...
CVE-2026-96758: Improper Control of Generation of Code
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...