Lucene search
+L

9109 matches found

OSV
OSV
added 2026/07/07 8:48 p.m.17 views

CVE-2026-55592 Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

3.9CVSS6AI score
SaveExploits0References5
OSV
OSV
added 2026/07/07 2:34 p.m.9 views

PYSEC-2026-1720 Open WebUI Vulnerable to a Session Fixation Attack

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

7.6CVSS7.7AI score0.00675EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/07 2:34 p.m.9 views

PYSEC-2026-1946 Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability Summary A type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

3.7CVSS6AI score0.00375EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 1:1 p.m.9 views

GHSA-26V7-H57M-GH9M New API is vulnerable to CSRF through user email binding

Summary The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth...

5.3CVSS5.9AI score0.00159EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/07 1:1 p.m.9 views

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GET /api/oauth/email/bind and GET /api/oauth/wechat/bind endpoints. An attacker can alter account binding state by tricking a logged-in user into visiting a crafted link, potentially allowing the...

6CVSS5.9AI score0.00159EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/07 10:16 a.m.19 views

CVE-2026-49296

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

6.5CVSS0.00384EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/07/07 6:46 a.m.9 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/07 6:39 a.m.14 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/07 6:33 a.m.11 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/07 6:33 a.m.9 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
SUSE CVE
SUSE CVE
added 2026/07/07 2:37 a.m.13 views

SUSE CVE-2026-13822

Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. Chromium security severity: High...

6.5CVSS6AI score0.00164EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:37 a.m.15 views

SUSE CVE-2026-13838

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

6.5CVSS6AI score0.00224EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:36 a.m.13 views

SUSE CVE-2026-13881

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

6.5CVSS6AI score0.00211EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:35 a.m.12 views

SUSE CVE-2026-13921

Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

6.5CVSS6AI score0.00328EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:35 a.m.19 views

SUSE CVE-2026-13924

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

6.5CVSS6AI score0.00315EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:33 a.m.9 views

SUSE CVE-2026-14023

Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

6.5CVSS6AI score0.00319EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:33 a.m.8 views

SUSE CVE-2026-14039

Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...

4.3CVSS6AI score0.00161EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:33 a.m.11 views

SUSE CVE-2026-14046

Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...

4.3CVSS6AI score0.00181EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:33 a.m.9 views

SUSE CVE-2026-14057

Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...

4.3CVSS6AI score0.00188EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:32 a.m.9 views

SUSE CVE-2026-14079

Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...

4.3CVSS6AI score0.00188EPSS
SaveExploits0References3
Rows per page
Query Builder