4215 matches found
Splunk Cloud Platform和Splunk Enterprise 日志信息泄露漏洞
Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. Both Splunk Enterprise and Splunk Clo...
PT-2026-20295
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop...
The vulnerability of the EcoStruxure Building Operation Workstation interface and the EcoStruxure Building Operation WebStation software’s web interface arises from incorrect restrictions on XML links to external objects. This allows attackers to gain unauthorized access to protected information or cause service failures.
The vulnerability of the EcoStruxure Building Operation Workstation interface and the EcoStruxure Building Operation WebStation software’s web interface is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow an attacker to gain unauthorize...
ezBookkeeping 安全漏洞
ezBookkeeping is a lightweight personal accounting application developed by mayswind developers. Versions of ezBookkeeping 1.2.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of nested depths during the processing of JSON and XML file...
Missing XML Validation
Apache Struts is vulnerable to Missing XML Validation. The vulnerability is due to improper validation of XML input data, which allows an attacker to exploit the application by submitting crafted XML content that bypasses security controls...
CVE-2026-2032
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1...
The vulnerability of Google Chrome’s WebGPU component, which allows a hacker to trigger a service failure.
The vulnerability of Google Chrome’s WebGPU component relates to reading beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially crafted HTML page...
CVE-2026-0693 Allow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions
The Allow HTML in Category Descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via category descriptions in all versions up to, and including, 1.2.4. This is due to the plugin unconditionally removing the wpksesdata output filter for termdescription, linkdescription,...
PT-2026-8060
The Link Hopper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hop name’ parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access,...
expat: Fix of CVE-2026-24515
CVE-2026-24515: Fix a null pointer dereference in the XML parser caused by the failure to copy user data for unknown encoding handlers...
CLSA-2026-1770734656 expat: Fix of CVE-2026-24515
CVE-2026-24515: Fix a null pointer dereference in the XML parser caused by the failure to copy user data for unknown encoding handlers...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC), a virtual device for collecting user authentication data, allows attackers to carry out XSS attacks.
The vulnerability of the Cisco Identity Services Engine ISE web interface and the Cisco ISE Passive Identity Connector ISE-PIC virtual authentication data collection device is related to the failure to implement measures to neutralize HTML tags. Exploiting this vulnerability allows a malicious...
Heatmiser Netmonitor 跨站脚本漏洞
Heatmiser Netmonitor is a temperature control system controller developed by Heatmiser Corporation. Version 3.03 of Heatmiser Netmonitor contains a cross-site scripting vulnerability. This vulnerability stems from an HTML injection in the outputtitle parameter of the outputSetup.htm page, which m...
CVE-2026-2316
Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-2316
Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
Denial Of Service
Django is vulnerable to Denial Of Service. The vulnerability is due to inefficient processing of unmatched HTML end tags in Truncator.chars and Truncator.words with html=True and related template filters, where crafted input containing a large number of unmatched closing tags can trigger excessiv...
PT-2026-7638
Name of the Vulnerable Software and Affected Versions Mealie version 3.3.1 Description A stored HTML injection issue exists in the Recipe Notes rendering component. A remote authenticated user can inject arbitrary HTML, which can lead to user interface redressing within the recipe view...
PT-2026-7676
KeePass Password Safe versions before 2.44 contain a denial of service vulnerability in the help system's HTML handling. Attackers can trigger the vulnerability by dragging and dropping malicious HTML files into the help area, potentially causing application instability or crash...
PT-2026-24865
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.71 Description A use-after-free issue exists in the Agents component of Google Chrome. This flaw could allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML...