70 matches found
CVE-2026-26964
Windmill CVE-2026-26964 affects Windmill versions 1.634.6 and earlier. The issue allows non-admin workspace members to access the Slack OAuth client secret via GET /api/w/{workspace}/workspaces/get_settings, revealing a secret that should be admin-only. Root cause: Slack configuration was stored ...
PT-2026-3437
Name of the Vulnerable Software and Affected Versions Altium Forum affected versions not specified Description A stored cross-site scripting XSS issue exists in the Altium Forum because of insufficient server-side input sanitization of forum post content. An authenticated attacker can inject...
CVE-2026-1009 Stored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data Exposure
A stored cross-site scripting XSS vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post...
EUVD-2022-52556
Malicious code in bioql PyPI...
EUVD-2025-27052
Malicious code in bioql PyPI...
CVE-2025-61590
Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution RCE attacks through Visual Studio Code Workspaces. Workspaces allow users to open more than a single folder and save specific settings pretty similar to .vscode/settings.json for...
CVE-2025-61590 Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection
Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution RCE attacks through Visual Studio Code Workspaces. Workspaces allow users to open more than a single folder and save specific settings pretty similar to .vscode/settings.json for...
Cursor 代码注入漏洞
Cursor is an AI code editor from the Cursor open source. A code injection vulnerability exists in Cursor 1.6 and earlier versions, which stems from an attacker being able to modify workspace settings via Visual Studio Code Workspaces, potentially leading to remote code execution...
PT-2025-40535
Name of the Vulnerable Software and Affected Versions Cursor versions 1.6 and below Description Cursor, a code editor for programming with AI, is susceptible to Remote Code Execution RCE attacks through Visual Studio Code Workspaces. Workspaces allow users to save specific settings for folders or...
CVE-2025-58372
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code workspace configuration files .code-workspace are not protected in the same way as the .vscode folder. If the agent was configured to auto-appro...
CVE-2025-58372
Roo Code CVE-2025-58372 affects versions ≤3.25.23 where certain VS Code workspace files (.code-workspace) aren’t protected like the .vscode folder. If auto-approve for file writes is enabled and prompts are manipulated (e.g., via prompt injection), an attacker could write malicious workspace sett...
PT-2025-36340
Name of the Vulnerable Software and Affected Versions: Roo Code versions 3.25.23 and below Description: Roo Code, an AI-powered autonomous coding agent, is susceptible to a flaw where VS Code workspace configuration files .code-workspace lack the same protection as files within the .vscode folder...
CVE-2022-29815
In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible...
CVE-2020-1192
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1171...
Improper access control
Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows local attackers to set some setting value in work space...
PT-2022-20264
Name of the Vulnerable Software and Affected Versions PersonaManagerService versions prior to SMR Jun-2022 Release 1 Description The issue is related to improper handling of insufficient permissions in the addAppPackageNameToAllowList function within the PersonaManagerService. This allows local...
Samsung mobile 安全漏洞
Samsung mobile is a cell phone from Samsung South Korea. Samsung mobile PersonaManagerService is vulnerable to an authorization issue that stems from improper permission management in addAppPackageNameToAllowList, which can be exploited by local attackers to A local attacker can use the...
JetBrains IntelliJ IDEA Code Injection Vulnerability (CNVD-2022-55680)
JetBrains IntelliJ IDEA is a suite of integrated development environments for the Java language from Jetbrains Czech Republic.A code injection vulnerability exists in versions of JetBrains IntelliJ IDEA prior to 2022.1, which could be exploited by attackers to execute native code via workspace...
