21830 matches found
CVE-2026-115416
Amazon Athena engine version 3 contained incorrect authorization checks during query processing. This vulnerability could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Notably, query results and data stored in Ama...
Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-56851, CVE-2026-56852.
Summary golang.org/x/text is used by the CPD Scheduling Service. CVE-2026-56851, CVE-2026-56852. Vulnerability Details CVEID:CVE-2026-56851 DESCRIPTION: The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. CWE:CWE-787:...
EUVD-2026-102241
ammonia: mXSS via MathML annotation-xml encoding strip...
CVE-2026-96382
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2...
CVE-2026-96641
A flaw was found in Pillow. When processing text dimensions with certain fonts, negative character spacing values are not properly validated during text-width calculation, causing an integer overflow. A remote attacker could exploit this vulnerability by providing crafted text or font data to an...
CVE-2026-109710
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Text component...
CVE-2026-109765
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Race condition, use-after-free in the Graphics: Text component...
CVE-2026-113096
A flaw was found in chromium-browser. A remote attacker could execute arbitrary code within the browser sandbox by tricking a user into visiting a specially crafted HTML page. This issue stems from a memory corruption vulnerability during text processing...
DRUPAL-CONTRIB-2026-230
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...
DRUPAL-CONTRIB-2026-228
The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to...
CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
WinboxPoC
WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and updat...
Linux Distros Unpatched Vulnerability : CVE-2026-109765
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird...
PT-2026-120907
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...
Linux Distros Unpatched Vulnerability : CVE-2026-113096
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a...
Membership Inference Attack on Private Evolution
Synthetic Data Generation SDG is an actively studied way to enable safe sharing of private data more broadly. Inference-only SDG methods, such as Private Evolution PE, are particularly appealing, as they can leverage black-box access to pre-trained foundation models to generate high quality data...
Linux Distros Unpatched Vulnerability : CVE-2026-109710
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and...
SUSE CVE-2026-110756
Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...
SUSE CVE-2026-110757
Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...