3771 matches found
Oracle WebLogic Server Apache Log4j (July 2026 CPU) (12.2.1.4.0)
The 12.2.1.4.0 version of WebLogic Server installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory. - Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producin...
PT-2026-63979
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
CVE-2026-64795
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...
EUVD-2026-47808
Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers...
EUVD-2026-47806
Stored condition values could also execute HTML/JavaScript in administrator summaries...
RLSA-2026:40856 Important: python3.14 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
RLSA-2026:41949 Important: python3.14 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
EUVD-2026-47570
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: High...
PT-2026-63506
Name of the Vulnerable Software and Affected Versions Regular Labs extensions affected versions not specified Description Cross-site scripting XSS is possible through tag-provided custom HTML, module content or title overrides, and decoded modal or tooltip values. This allows a content author to...
PT-2026-63498
Name of the Vulnerable Software and Affected Versions Regular Labs conditions manager affected versions not specified Description Stored condition values can be used to execute malicious HTML or JavaScript within administrator summaries. This is a Cross-Site Scripting XSS issue, where a script is...
The vulnerability of the XML analysis mechanism in security systems and the Nessus vulnerability assessment tool allows attackers to execute arbitrary SQL queries.
The vulnerability of the XML analysis mechanism of the security system and the Nessus vulnerability assessment tool is related to the lack of measures taken to protect the SQL query structure during the processing of the nessus file. Exploiting this vulnerability allows an attacker to execute...
DEBIAN-CVE-2026-16415
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: High...
[20260806] - Core - XSS through schema.org outputs
Improper escaping flags lead to an XSS vector in schema.org markup outputs...
python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations
A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...
CVE-2026-12970
The CVE-2026-12970 entry concerns LearnPress for WordPress (before 4.4.1). The vulnerability is a Reflected Cross-Site Scripting flaw where a search parameter is not escaped before being echoed into an HTML attribute (parameter: c_search). This can affect a logged-in instructor or administrator w...
PT-2026-61808
Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS...
ALSA-2026:41949 Important: python3.14 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
Summary The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces...
CVE-2026-49216
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in createAutocompleteWithRemoteData by interpolating the text field into HTML template literals $itemlabelField rather than text,...