1670 matches found
CVE-2026-91922
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...
EUVD-2026-78413
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...
CVE-2026-91922
Steedos Platform through version 3.0.15-beta.47 is affected by a reflected cross-site scripting (XSS) vulnerability in the anonymous /api/page/render endpoint. The root cause is the failure to properly escape query parameters within inline script elements. An attacker can craft malicious links co...
CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...
CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...
CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...
PT-2026-91927
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15
A NULL pointer dereference vulnerability was discovered in the vmwgfx driver, located in the file vmwgfxexecbuf.c within the GPU component of the Linux kernel. The vulnerability affects device files such as '/dev/dri/renderD128' or 'Dxxx'. This flaw allows a local attacker with a user account on...
Astra Linux – Vulnerability in htmldoc
A flaw was discovered in htmldoc version 1.9.12. A heap buffer overflow in the rendertablerow function, located in ps-pdf.cxx, may lead to arbitrary code execution and denial of service...
Astra Linux – Vulnerability in xorg-server
A use-after-free vulnerability was discovered in the ProcRenderAddGlyphs function of Xorg servers. This issue arises when the AllocateGlyph function is called to store new glyphs sent by the client to the X server. As a result, multiple entries may point to the same non-refcounted glyphs...
Astra Linux – Vulnerability in libsdl2
A potential memory leak issue was discovered in the SDL2 library, specifically in the GLESCreateTexture function within the SDLrendergles.c file. This vulnerability allows an attacker to carry out a denial-of-service attack. The vulnerability affects SDL2 version 2.0.4 and later versions. SDL-1.x...
Astra Linux – Vulnerability in WebKit2GTK
A use-after-free vulnerability exists in WebCore::RenderLayer::renderer in WebKitGTK before version 2.36.8, allowing attackers to execute code remotely...
Astra Linux – Vulnerability in DjVuLibre
A flaw was discovered in djvulibre-3.5.28 and earlier. An integer overflow in the render function in tools/ddjvu, through a crafted djvu file, may cause the application to crash and lead to other issues...
Astra Linux – Vulnerability in Firefox and Thunderbird
Using tables within an iframe, an attacker could cause the iframe contents to be rendered outside the boundaries of the iframe, leading to potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...
CVE-2026-10148: Improper Neutralization of Input During Web Page Generation
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...
CVE-2026-5399: Improper Neutralization of Input During Web Page Generation
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...
CVE-2026-85630: Improper Neutralization of Input During Web Page Generation
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...
CVE-2026-52772
YesWiki prior to 4.6.6 is vulnerable to stored XSS in its Bazar form-field templates. Twig's |raw('html') filter suppresses auto-escaping of field.label and field.hint in attribute and label-body contexts across at least seven templates. The base layout layouts/input.twig is inherited by every fi...