18451 matches found
GHSA-27VJ-QCQG-25RC fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...
CVE-2026-105315
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
DEBIAN-CVE-2026-105315
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
CVE-2026-105315
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
EUVD-2026-92429
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
CVE-2026-105315
A vulnerability exists in django-haystack versions up to 3.3.0 within the more_like_this Template Tag Handler. Specifically, the _to_python function in haystack/backends/elasticsearch_backend.py is susceptible to eval injection (CWE-95, CWE-94) because manipulation of the result_class argument le...
CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
Astra Linux – Vulnerability in Zabbix
Templates do not properly handle backticks as JavaScript string delimiters, and do not escape them as expected. Backticks have been used since ES6 for JavaScript template literals. If a template contains a Go template action within a JavaScript template literal, the contents of the action can be...
Astra Linux – Vulnerability in Chromium
Integer overflow in WTF in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Python-Django
Django versions prior to 2.2.24, 3.x prior to 3.1.12, and 3.2.x prior to 3.2.4 have a potential issue with directory traversal through django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default...
Astra Linux – Vulnerability in Mako
Mako is a template library written in Python. Prior to version 1.3.11, the TemplateLookup.gettemplate function was vulnerable to path traversal attacks when the URI started with // e.g., //../../../secret.txt. The root cause of this issue was an inconsistency in the two implementations of slash...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Important: Red Hat Security Advisory: rhc-worker-script security update
An update for rhc-worker-script is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2025-29306
CVE-2025-29306 Vulnerabilidad de inyección de parámetros de servicio en el sistema de gestión de contenido FOXCMS Qianhu I. Introducción a la vulnerabilidad FoxCMS es un sistema de gestión de sitios web gratuito y de código abierto, construido con PHP+MySQL. El sistema de gestión de contenido...
[SECURITY] [DLA 4820-1] node-lodash security update
----------------------------------------------------------------------- Debian LTS Advisory DLA-4820-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 05, 2026 https://wiki.debian.org/LTS -...
PT-2026-105984
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function to python of the file haystack/backends/elasticsearch backend.py of the component more like this Template Tag Handler. Such manipulation of the argument result class leads to improper neutralization of...
CVE-2026-105315: Improper Neutralization of Directives in Dynamically Evaluated Code
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...
Debian dla-4820 : libjs-lodash - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4820 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4820-1 [email protected]...