85087 matches found
CVE-2026-77181
creationtimestamp| type| source ---|---|--- 2026-09-14 19:30:22+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvitv3uufk2t...
CVE-2026-55847
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...
CVE-2026-55846
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...
CVE-2026-55846
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...
CVE-2026-55847
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...
UBUNTU-CVE-2026-55846
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...
UBUNTU-CVE-2026-55847
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...
CVE-2026-55847
Allure 2 (a multi-language test reporting tool) is vulnerable to stored XSS in the ansi.js Handlebars helper within allure-generator. Prior to 2.39.0 , attacker-controlled statusMessage and statusTrace values (sourced from JUnit XML, TRX, xUnit, xctest, or Allure1/2 plugins) are passed through th...
CVE-2026-55846 Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...
EUVD-2026-77687
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...
CVE-2026-55846 Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...
CVE-2026-90943
creationtimestamp| type| source ---|---|--- 2026-09-14 17:20:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvimmngx652r 2026-09-14 18:08:27+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvipd33ojl2f...
CVE-2026-20353
creationtimestamp| type| source ---|---|--- 2026-09-14 16:42:48+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117270391382884208 2026-09-14 17:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvin6h3atz22 2026-09-14 18:08:38+00:00| seen|...
CVE-2026-90961
creationtimestamp| type| source ---|---|--- 2026-09-14 15:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvifvz2uiq2g 2026-09-14 16:07:30+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mviikrvwar2p...
CVE-2026-61642
creationtimestamp| type| source ---|---|--- 2026-09-14 14:00:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvibhkzfye2c 2026-09-16 00:31:51+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mvlv7kvrdy2y 2026-09-17 00:31:33+00:00| seen|...
CVE-2026-88035
creationtimestamp| type| source ---|---|--- 2026-09-14 14:00:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvibhel47j2u...
Wordfence Bug Bounty Program Monthly Report β May 2026
In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...
CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...
CVE-2026-90957
MISP versions β€2.5.45 are affected by a stored XSS vulnerability in the serve path for uploaded SVG images , which are delivered inline without a restrictive browser sandbox. Because SVGs are XML documents rather than passive bitmaps, embedded [removed] elements, event handlers, or javascript: UR...
CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...