111968 matches found
CVE-2026-54889
Improper Neutralization of Input During Web Page Generation XSS vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':todelta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':defaultconvertnode/3 in...
CVE-2026-54889
Summary: CVE-2026-54889 security issue in Elixir.MDEx.mdex Delta conversion path allows XSS via unsanitized URL schemes in Quill Delta output. The vulnerability arises when Elixir.MDEx.DeltaConverter.default_convert_node/3 copies the URL from link, wikilink, or image nodes into the Delta attribut...
EEF-CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
Summary Improper Neutralization of Input During Web Page Generation XSS vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':to\delta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':default\convert\node/3...
CVE-2026-57958
creationtimestamp| type| source ---|---|--- 2026-06-29 19:09:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph6tdx2xt22 2026-06-29 21:24:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphgf7rael2y...
CVE-2026-57946
creationtimestamp| type| source ---|---|--- 2026-06-29 18:53:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5w56s7h2g 2026-06-29 21:17:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphfxm2eap2k...
CVE-2025-70101
creationtimestamp| type| source ---|---|--- 2026-06-29 18:53:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mph5vwj3n22g...
CVE-2026-57950
creationtimestamp| type| source ---|---|--- 2026-06-29 18:49:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5pretwz23 2026-06-29 21:57:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphi75nrkv2n 2026-06-29 22:25:35+00:00| seen|...
CVE-2026-56780
creationtimestamp| type| source ---|---|--- 2026-06-29 18:46:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5k4naqc2n...
CVE-2026-57948
creationtimestamp| type| source ---|---|--- 2026-06-29 18:35:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph4vqqetc2b 2026-06-29 21:28:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphglkar5j2e...
CVE-2026-54231
creationtimestamp| type| source ---|---|--- 2026-06-29 18:16:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph3vg2wcb2d...
CVE-2026-57955
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...
CVE-2026-56285
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including...
CVE-2026-11720
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-13590
creationtimestamp| type| source ---|---|--- 2026-06-29 17:51:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2ilx2mu2d 2026-06-29 19:56:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphbh5w62h2x 2026-06-29 20:42:39+00:00| seen|...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
EUVD-2026-40146
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720
The CVE-2026-11720 entry describes a path traversal flaw in the HTTP tool URL builder of googleapis/mcp-toolbox. User-controlled pathParams are substituted into a configured tool path and then parsed as a relative URL; while scheme/host/user info are checked, final resolution uses ResolveReferenc...