CVE-2026-108802

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2026-108802

A cross-site scripting (XSS) vulnerability exists in y_project RuoYi (up to version 4.8.3 ) within the Dictionary Data Drawer Preview component. The flaw is located in the renderDrawer function of the /system/dict/data/add file, where a lack of proper input validation on the cssClass argument all...

CVE-2026-108802 y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

EUVD-2026-97234

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2026-108802: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

PT-2026-110655

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.7.0 through 0.9.3 Description A server-side request forgery SSRF issue exists where API clients can access internal addresses. By enabling link preview config on the '/crawl' endpoint, an attacker can provide a controlled...

CVE-2026-109562: Missing Authorization

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

PT-2026-110471

Name of the Vulnerable Software and Affected Versions y project RuoYi versions prior to 4.8.4 Description A remote cross site scripting issue exists in the Dictionary Data Drawer Preview component. The problem occurs within the renderDrawer function located in the /system/dict/data/add file. An...

ttddbg

ttddbg - Time Travel Debugging IDA plugin ⚠️ Attention IDA 8 users: using ttddbg with IDA 8 require a work-around for the moment, seeKnown issues This plugin adds a new debugger to IDA which supports loading Time Travel Debugging traces generated using WinDBG Preview. This plugin supports both x86...

sandbox-runtime

Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...

noia

Noia Noia es una herramienta basada en web cuyo objetivo principal es facilitar el proceso de exploración del sandbox de aplicaciones móviles y la previsualización directa de bases de datos SQLite, imágenes y más. Desarrollada con frida.re. Ten en cuenta que no soy programador, pero probablemente...

CVE-2026-103482 Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields e.g. firstname' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-103482

The Simple Newsletter Plugin (Noptin) for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to and including 4.3.10 . The root cause is insufficient input sanitization and output escaping within the noptin_fields[] parameter. An unauthenticated attacker c...

CVE-2026-103482 Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields e.g. firstname' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...

CVE-2026-108261

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

NPM: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

NPM: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment vulnerability discovered by ? in WordPress Npm tinacms versions = 3.13.0...

GHSA-X34J-47HF-4XG7 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

GHSA-Q6WP-FR43-GM9V Contao: Improper access control in the preview links module

core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass$class, false, gets null, silently skips the...