41542 matches found
CVE-2026-19988
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...
BIT-DISCOURSE-2026-72725 Discourse: Stored XSS in staff action logs injects staff UI
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...
BIT-HARBOR-2026-4404 Use of hard coded credentials in GoHarbor Harbor
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...
BIT-AIRFLOW-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...
CVE-2026-19988 Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...
CVE-2026-19988 Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...
CVE-2026-19988
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...
EUVD-2026-60051
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101331)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101331 advisory. When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any...
CVE-2026-75111: Improper Limitation of a Pathname to a Restricted Directory
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...
CVE-2026-19988: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...
Tanium Server 7.7.3.x < 7.7.3.8298 / 7.8.2.x < 7.8.2.1198 / 7.8.4.x < 7.8.4.1327 UI Misrepresentation (TAN-2026-017)
The version of Tanium Server installed on the remote host is 7.7.3.x prior to 7.7.3.8298, 7.8.2.x prior to 7.8.2.1198, or 7.8.4.x prior to 7.8.4.1327. It is, therefore, affected by a vulnerability: - A UI misrepresentation of critical information vulnerability could allow an authenticated Tanium...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100881)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100881 advisory. A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefo...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-100949)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100949 advisory. Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird...
PT-2026-73303
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...
PT-2026-72211
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak exists in the llc ui autobind function. The function opens a Service Access Point SAP after selecting a dynamic Logical Link Control Service Access Point LSAP. Whi...
Malicious code in bootstrap-custom-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b61501946d7df441ba0b302898ff5aa223b09828775504099fc8d91878d81 The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS request to the hardcoded...
MAL-2026-14030 Malicious code in bootstrap-custom-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b61501946d7df441ba0b302898ff5aa223b09828775504099fc8d91878d81 The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS request to the hardcoded...
CVE-2026-65975
A flaw was found in Pydantic AI's UI adapters, specifically within the sanitizemessages function. This vulnerability allows a remote client to bypass security checks and execute server tools with arguments they provide, rather than those generated by the AI model. This occurs when a trailing clie...
