41511 matches found
CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed
Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...
CVE-2026-54743
Lemmy (a fediverse link aggregator and forum) is affected by a stored XSS in lemmy-ui prior to version 0.19.19-beta.1 . The root cause lies in src/shared/markdown.ts, where mdToHtml returns a raw __html object injected by Inferno without a sanitizer pass. The [email protected] plugin,...
EUVD-2026-62848
Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...
Malicious Package
Overview dolyame-ui-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview @idanefraim/my-ui-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview @sarex-team/ui-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview colorpicker-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview table-ui-new is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MINI-MCWM-R84M-MVWM
Bulletin has no description...
CVE-2026-18372
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...
CVE-2026-18371
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...
MAL-2026-14309 Malicious code in @idanefraim/my-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24017bfaf88f4ffe9c661b8ff489bded977a522bcc9ace9bf7289b11fdf37f84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
SummaryA client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client...
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
SummaryA client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client...
PYSEC-2026-3692 Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
PYSEC-2026-3693 Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
elyra (>=2.0.0, <=3.0.0rc1), elyra-code-snippet-extension (>=2.2.0, <=3.0.0rc1) +11 more potentially affected by CVE-2026-73415 via jupyterlab (3.3.4)
jupyterlab PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra =2.0.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0, =0.1.1.10, =0.1.6.2, =0.0.1, =0.1.0, =0.0.13, =0.0.24 - retrolab 0.3.20 Source cves:...
CVE-2026-18372 CSS injection in M-Files Web
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...
CVE-2026-18372
M-Files Web before version 26.8.16330.2 is affected by a CSS injection vulnerability. An authenticated vault administrator can inject arbitrary CSS into the web user interface displayed to other vault users, resulting in low integrity impact on both the vulnerable and subsequent systems. The CVSS...