46144 matches found
CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...
CVE-2026-65606
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, SiYuan Desktop opens a custom tab and inserts the link’s icon parameter into the tab header via innerHTML without ...
PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...
bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purgekvmap in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The...
PYSEC-2026-3469 bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purgekvmap in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The...
CVE-2026-65489
CVE-2026-65489 affects the WordPress plugin “LA-Studio Element Kit for Elementor” up to version 1.6.2. The issue is described as Unauthenticated Broken Access Control, allowing access to restricted functionality without credentials. The referenced CVSS 3.1 base score is 5.3 (MEDIUM) with network ...
CVE-2026-65489 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65489 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65489
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...
EUVD-2026-48100
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65488 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...
EUVD-2026-48099
Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65488 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65488
The CVE concerns the WordPress plugin LA-Studio Element Kit for Elementor, version <= 1.6.2. It describes an unauthenticated Cross-Site Request Forgery (CSRF) that can lead to Stored XSS. The issue originates from the plugin’s handling of CSRF, enabling an attacker to trigger stored XSS withou...
CVE-2026-65488
Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65482 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65482 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in LA-Studio Element Kit for Elementor = 1.6.2 versions...
EUVD-2026-48093
Contributor Cross Site Scripting XSS in LA-Studio Element Kit for Elementor = 1.6.2 versions...