CVE-2026-45733

CVE-2026-45733 is a stored XSS in Trilium Notes (prior to 0.103.0) that escalates to remote code execution on the victim's operating system. The #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in quick_search.ts and note_a...

UBUNTU-CVE-2026-74969

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

GHSA-Q8CG-5M48-5C25 Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media <source> URL

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6qw9-4vv5-jr97. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering throug...

Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media <source> URL

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6qw9-4vv5-jr97. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering throug...

CVE-2026-74969

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-75831

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-75107

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...

CVE-2026-75831 Grav before 2.0.15 Stored XSS via audio/video source URL

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-75831 Grav before 2.0.15 Stored XSS via audio/video source URL

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-75831

Grav (a flat-file CMS) before 2.0.15 is affected by a stored cross-site scripting (XSS) vulnerability in the audio and video media rendering pipeline. The root cause is that the sourceParsedownElement method concatenates the media URL fragment unescaped into raw HTML elements, allowing an authen...

CVE-2026-75831

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-75831

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

PT-2026-76931

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.15 Description Stored cross-site scripting occurs during the rendering of audio and video media via the sourceParsedownElement function. The issue arises because the media URL fragment is concatenated without being...

CVE-2026-75483

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

CVE-2026-75483

powerlevel10k fails to sanitize control characters in the package.json version field when rendering the package prompt segment, allowing an attacker to embed raw escape bytes that emit arbitrary terminal control sequences on each prompt render when a user enters a compromised directory. CVSS 3.1 ...

CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

GHSA-QCPP-8X79-HHP3 Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Summary The Glances action system lets an administrator configure shell commands that run when a monitoring threshold is crossed. The command is a Mustache template whose variables are filled with runtime stat fields such as a process name, a container name or a filesystem mount point. Those fiel...

CVE-2026-75483: Improper Neutralization of Escape, Meta, or Control Sequences

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...