10790 matches found
CVE-2026-23733: Improper Control of Generation of Code
LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting XSS vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Executi...
CVE-2026-22638
A cross-site scripting XSS vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permission...
CVE-2026-22638
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-22638
A cross-site scripting (XSS) vulnerability exists in Grafana caused by a combination of client path traversal and open redirect. This can redirect users to a site hosting a frontend plugin that executes arbitrary JavaScript, without requiring editor permissions; anonymous access may enable exploi...
CVE-2026-22638
...
PT-2026-3005
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A cross-site scripting XSS issue exists in Grafana due to a combination of client path traversal and open redirect. This allows attackers to redirect users to a website hosting a frontend...
CVE-2026-22813
OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response...
Astra Linux – Vulnerability in Chromium
The poor implementation of the Loader component in Google Chrome before version 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...
CVE-2026-22813
OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response...
CVE-2026-22813 Malicious website can execute commands on the local system through XSS in the OpenCode web UI
OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response...
CVE-2026-22813: Improper Neutralization of Input During Web Page Generation
OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response...
opencode 安全漏洞
opencode is an AI programming intelligence open-sourced by Anomaly. A security vulnerability exists in versions prior to opencode 1.1.10, which stems from the Markdown renderer not cleaning up the LLM response, and could lead to the execution of JavaScript via HTML injection...
PT-2026-24885
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.71 Description A flaw exists in Google Chrome’s Clipboard functionality due to insufficient policy enforcement. This could allow a remote attacker who has compromised the renderer process to leak...
CVE-2019-20857
An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service markdown renderer hang via many backtick characters...
GHSA-RX8G-88G5-QH64 vulnerabilities
Vulnerabilities for packages: grafana-image-renderer, opensearch-dashboards...
CVE-2025-57352 vulnerabilities
Vulnerabilities for packages: grafana-image-renderer, opensearch-dashboards...
GHSA-RX8G-88G5-QH64 vulnerabilities
Vulnerabilities for packages: foxx-cli, grafana-image-renderer, opensearch-dashboards-fips, gitlab-rails-ce, commercial-gitlab-rails-ee, opensearch-dashboards, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, arangodb...
CVE-2025-57352 vulnerabilities
Vulnerabilities for packages: foxx-cli, grafana-image-renderer, opensearch-dashboards-fips, gitlab-rails-ce, commercial-gitlab-rails-ee, opensearch-dashboards, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, arangodb...
PT-2026-26522
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.153 Description A flaw exists in Google Chrome's Navigation feature due to inadequate validation of untrusted input. This could allow a remote attacker who has already compromised the renderer process...