4334844 matches found
CVE-2026-56722
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-56722
Dompdf (PHP HTML-to-PDF library) prior to v3.16 is vulnerable to local-file read via SVG in a data: URI. The attack wraps a local file path in an SVG image; dompdf processes the SVG twice, and the second pass hands the image to php-svg-lib with external references enabled. php-svg-lib then reads ...
EUVD-2026-50026
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-55554
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
CVE-2026-55555
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control...
GHSA-Q6VM-XQC9-V3FF Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control...
EUVD-2026-36071
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory...
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...
GHSA-VCHH-R53J-8MPW Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...
EUVD-2026-36073
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks...
CVE-2026-59689
creationtimestamp| type| source ---|---|--- 2026-07-28 20:15:10+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755 2026-07-28 20:45:12+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-7...
CVE-2026-59688
creationtimestamp| type| source ---|---|--- 2026-07-28 20:15:07+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755 2026-07-28 20:45:10+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-7...
CVE-2026-59687
creationtimestamp| type| source ---|---|--- 2026-07-28 20:15:05+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755 2026-07-28 20:45:07+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-7...
CVE-2026-59686
creationtimestamp| type| source ---|---|--- 2026-07-28 20:15:02+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755 2026-07-28 20:45:05+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-7...
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer, but the capability check was implemented as a fixed denylist of six Linux...
GHSA-QF5V-M7P4-95RP Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer, but the capability check was implemented as a fixed denylist of six Linux...