CVE-2025-55972

CVE-2025-55972 affects TCL Smart TVs with a vulnerable UPnP/DLNA MediaRenderer implementation. The issue arises when an attacker sends a flood of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint, enabling a remote, unauthenticated Denial of Service. The device b...

CVE-2025-55972

A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service DoS condition. By sending a flood of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint, an attacker can cause the device to becom...

CVE-2025-55971

CVE-2025-55971 affects TCL 65C655 Smart TV firmware V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+). The issue is a blind, unauthenticated Server-Side Request Forgery via the UPnP MediaRenderer AVTransport:1 service. The device accepts unauthenticated SetAVTransportURI SOAP requests over ...

SUSE CVE-2025-11205

Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-59343 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, code-server, tileserver-gl, sqlpad...

GHSA-VJ76-C3G6-QR5V vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, code-server, tileserver-gl, sqlpad...

CVE-2025-59053

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

CVE-2025-10234

A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /datapointedit.shtm of the component Data Point Edit Module. The manipulation of the argument Text Renderer properties results in cross site scripting. The attack can be launched remotely...

Project AIRI 代码注入漏洞

Project AIRI is an AI dialog bot open-sourced by moeru-ai. Project AIRI version 0.7.2-beta.2 suffers from a code injection vulnerability that stems from the MarkdownRenderer.vue component directly using v-html to render unescaped HTML content, which could lead to cross-site scripting attacks, as...

Scada-LTS 代码注入漏洞

Scada-LTS is an open source, web-based, multi-platform solution from Scada-LTS Open Source. A code injection vulnerability exists in Scada-LTS version 2.7.8.1 and earlier, which stems from misuse of the parameter Text Renderer properties in the file /datapointedit.shtm, and could lead to a...

CVE-2025-10234

CVE-2025-10234 affects Scada-LTS before 2.7.8.2, with the vulnerability residing in the Data Point Edit Module’s /data_point_edit.shtm. The issue stems from improper handling of the Text Renderer properties argument, enabling cross-site scripting (XSS) when the page is accessed remotely. The publ...

ROS-20250910-03

Vulnerability of Poppler PDF rendering library is related to lack of object threads cleanup PDF when cairodebugresetstaticdata is called. Exploitation of the vulnerability could allow an attacker to gain access to confidential information...

CVE-2025-22423

In ParseTag of dngifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22423

In ParseTag of dngifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22423

In ParseTag of dngifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Linux Distros Unpatched Vulnerability : CVE-2021-25283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

PT-2025-35627

Name of the Vulnerable Software and Affected Versions: dng ifd.cpp affected versions not specified Description: A missing bounds check in the ParseTag function within dng ifd.cpp may lead to a crash of the image renderer, potentially resulting in a remote denial of service. Exploitation does not...

Linux Distros Unpatched Vulnerability : CVE-2022-32308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' ...

CVE-2025-7969

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in markdown-it allows Cross-Site Scripting XSS. This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not conside...

DEBIAN-CVE-2025-7969

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in markdown-it allows Cross-Site Scripting XSS. This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not conside...