CVE-2026-73506

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

CVE-2026-73506

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

CVE-2026-73506 Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

EUVD-2026-58078

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name...

CVE-2026-73505 Oh My Posh: Arbitrary command execution via template injection in the path segment

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name...

PT-2026-71872

Name of the Vulnerable Software and Affected Versions gdu affected versions not specified Description The software fails to strip terminal escape sequences from directory and file names when printing paths after exiting the Terminal User Interface TUI. This allows attackers to create malicious fi...

CVE-2026-73422

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

EUVD-2026-57606

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422

CVE-2026-73422 (Astro) : From 2.9.0 through 7.1.0, Astro’s server-side View Transition CSS generator serializes animation properties into an inline style element without escaping for CSS/HTML contexts. An attacker-controlled value (e.g., duration) can terminate the style element and inject arbitr...

CVE-2026-73422

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-15217

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content b...

CVE-2026-15217 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content b...

CVE-2026-73237

An XSS vulnerability exists in the Markdown handling pipeline of Apache Allura . This flaw affects versions from 1.10.0 before 1.19.1 . The vulnerability allows for the improper neutralization of script-related HTML tags in a web page. To remediate this issue, users are recommended to upgrade to ...

CVE-2026-19149 vulnerabilities

Vulnerabilities for packages: chromium...

Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

CVE-2026-19559

Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-19559

A Use after free vulnerability in the HTML component of Google Chrome (prior to version 151.0.7922.137 ) allows a remote attacker to execute arbitrary code inside a sandbox using a crafted HTML page. This vulnerability also affects Opera (earlier than 135.0.5973.41 ) and Microsoft Edge (Chromium-...

CVE-2026-72781

creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:12+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...

EUVD-2026-56927

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...