CLEANSTART-2024-DP35912 When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files

Security vulnerability affects the librewolf package. When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files...

cve-2017-0065

Exploiting Edge's read:// urlhandler Introduction This exploit was reported to Microsoft and I was acknowledged for doing so. The exploit has been patched on March 14th 2017 under names cve-2017-0065 and MS17-007 and will not work if related patches are applied. Sourcecode is provided for...

Fedora 44 : evolution / evolution-data-server (2026-df461d043b)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-df461d043b advisory. Backport upstream patches for CVE-2026-110777 Calendar: Limit which local files are inlined in components Tenable has extracted the preceding description blo...

CVE-2026-118039

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is...

CVE-2026-118039

Progress Telerik Document Processing Libraries versions prior to 2026.3.1027 are vulnerable to an XML external entity reference vulnerability in SVG image processing. An unauthenticated attacker can exploit this by providing a crafted SVG image containing a nested embedded SVG. If the library pro...

CVE-2026-112198 Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App

XML External Entity XXE injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide ...

MAL-2026-18368 Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

PT-2026-128221

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is...

CVE-2026-102638

A maliciously crafted HTML payload in the description of an electronic library .lbr file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage thi...

CVE-2026-102636

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or...

CVE-2026-102638 Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in the description of an electronic library .lbr file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage thi...

CVE-2026-102638

The Autodesk Fusion desktop application is vulnerable to a Stored Cross-site Scripting (XSS) vulnerability. The issue is triggered when a maliciously crafted HTML payload within the description of an electronic library (.lbr) file is displayed in the Library Manager after the library is imported....

CVE-2026-102637 Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to re...

CVE-2026-102637

The Autodesk Fusion desktop application is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of input in the documentName parameter of a Fusion protocol URL. When a user invokes a maliciously crafted protocol URL, the application may execute an HTML payload, potent...

CVE-2026-102636 Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or...

Exploit for CVE-2026-93328

The layer CVE-2026-93328 was missing CVE-2026-93328 / GHSA-...

Google Cloud MCP Toolbox for Databases 1.4.0 Path Traversal

Google Cloud MCP Toolbox for Databases versions 1.2.0 through 1.4.0 contain a path traversal and missing authorization issue in the cloud-storage source that permits unauthenticated callers to read local files into external buckets or overwrite local files...

CVE-2026-102638: Improper Neutralization of Input During Web Page Generation

A maliciously crafted HTML payload in the description of an electronic library .lbr file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage thi...

PT-2026-126651

A maliciously crafted HTML payload in the description of an electronic library .lbr file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage thi...

Autodesk Fusion cross-site scripting vulnerability

Autodesk Fusion versions from 2705.1.30 up to and including 2706.1.14 contain a cross-site scripting vulnerability. This vulnerability arises because the documentName parameter in Fusion protocol URLs fails to properly handle maliciously crafted HTML payloads. When users access such protocol URLs...