LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

LeafKit HTML-escaping is not working correctly when a template prints a collection Array / Dictionary via value. This can result in XSS, allowing potentially untrusted input to be rendered unescaped...

The vulnerability of the sienna_cichlid_set_ppt_funcs() function in the drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c driver of the Direct Rendering Infrastructure (DRI) video card for Linux kernel allows a attacker to cause a system failure.

The vulnerability of the siennacichlidsetpptfuncs function in the drivers/gpu/drm/amd/pm/swsmu/smu11/siennacichlidppt.c driver of the Direct Rendering Infrastructure DRI for AMD graphics cards in Linux operating systems is related to improper memory release mechanisms memory leaks. Exploiting thi...

AnythingLLM 跨站脚本漏洞

AnythingLLM is an integrated AI application open source by Mintplex. Versions of AnythingLLM 1.11.1 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from the presence of a streaming-phase cross-site script in the chat rendering pipeline. Due to insecure...

Arbitrary Code Injection

Craft CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to unsafe use of unsandboxed Twig rendering with user-controlled input in the conditions system, which allows an attacker to execute arbitrary code through crafted condition rules...

@advancedco/design-system-workspace (4.0.0), @agdo/object-model (>=1.0.1, <=1.2.34) +1018 more potentially affected by CVE-2026-32635 via @angular/core (>=17.0.0-next.3, <=18.2.14)

@angular/core NPM version =17.0.0-next.3, =1.0.1, =1.0.2, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.2, =1.0.0, =0.0.55, =0.0.1, =1.0.0, =1.0.1 and more Source cves: CVE-2026-32635 Source advisory: OSV:GHSA-G93W-MFHG-P222...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.192-alpha) +14 more potentially affected by CVE-2026-32635 via @angular/compiler (>=21.0.0, <=21.2.1)

@angular/compiler NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.77-rc.1, =0.0.1, =0.2.0, =0.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-32635 Source advisory: OSV:GHSA-G93W-MFHG-P222...

CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS...

CVE-2026-32626

CVE-2026-32626 affects AnythingLLM Desktop (1.11.1 and earlier). The root cause is in the chat rendering pipeline where user-provided content is interpolated into the alt attribute of an image in frontend/src/utils/chat/markdown.js without HTML entity escaping, combined with rendering the output ...

CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS...

EUVD-2026-11720

OneUptime: Stored XSS via Mermaid Diagram Rendering securityLevel: "loose"...

GHSA-WVH5-6VJM-23QH OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

Summary The Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary...

CVE-2026-31864

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection SSTI vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges...

CVE-2026-31864

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection SSTI vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges...

CVE-2026-31864

JumpServer is affected by a Server-Side Template Injection (SSTI) in the Applet and VirtualApp upload flow. The manifest.yml is rendered with Jinja2 without sandboxing when processing user-uploaded ZIP packages, allowing template injection. Exploitation requires administrative privileges (Applica...

EUVD-2026-12085

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection SSTI vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges...

CVE-2026-31864 JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection SSTI vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges...

CVE-2026-31864 JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection SSTI vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges...

BIT-GITLAB-2026-0602 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering...

PT-2026-25378

Another example of the nodeIntegration: true / contextIsolation: false combination leading to a critical security vulnerability in a production Electron application. AnythingLLM Desktop is a popular local LLM + RAG tool. Their streaming chat renderer does not sanitise LLM output before DOM...

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit, related to the occurrence of operations outside the buffer in memory, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the escape of operations beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...