Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60. The whitespace-skip loop right above lines 55-57 advances p.i to p.srcLen when the input is...

CVE-2026-95657

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657 dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

EUVD-2026-84604

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657

The dgtlmoon Changedetection.io application is vulnerable to cross-site scripting (XSS) in versions up to 0.55.8 . The flaw exists in the setCurrentSelectedText function of the changedetectionio/static/js/visual-selector.js file within the Visual Selector component. A remote attacker can trigger ...

CVE-2026-95657 dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657 dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

PT-2026-96716

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A path traversal issue exists in the visual selector data component within the static content function of the changedetectionio/flask app.py file. A remote attacker can manipulat...

PT-2026-96918

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

DEBIAN-CVE-2026-62866

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

CVE-2026-62866

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

UBUNTU-CVE-2026-62866

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

CVE-2026-62866

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

CVE-2026-62866

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

CVE-2026-62866: Improper Validation of Array Index

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

PT-2026-96157

Name of the Vulnerable Software and Affected Versions Dasel versions 3.0.0 through 3.11.1 Description In the parseCurRune function within selector/lexer/tokenize.go, the input index advances across trailing whitespace and reads the source at the exhausted index without performing an end-of-input...

Security Bulletin: IBM Event Endpoint Management is effected by Multiple Vulnerabilities

Summary IBM Event Endpoint Management is affected by Multiple Vulnerabilities and was addressed in IBM Event Endpoint Management 11.8.2 Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept extern...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ListArchivedWorkflows handler in server/workflowarchive/archivedworkflowserver.go. An attacker can read archived workflows from other namespaces by sending a metadata.namespace!=...

PT-2026-98922

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description The optional rabbitmq jms topic exchange plugin's x-jms-topic exchange accept...