Mermaid: Improper sanitization of configuration leads to CSS injection
CVE-2026-41159
### Impact Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the `fo
2026-05-12 归档
今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。
← 返回归档列表Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
CVE-2026-41150
### Impact Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if th
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
CVE-2026-41149
### Impact Under the default configuration, Mermaid state diagram's `classDef` allow DOM injection that escapes the SVG
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
CVE-2026-41148
### Details The state diagram and any other diagram type that routes user-controlled style strings through createCssSty
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
CVE-2026-40607
Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_r
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
CVE-2026-40596
Any authenticated user can inject arbitrary HTML via updating their account's font family. ### Impact Cross-site script
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
CVE-2026-39960
Improper escaping of a textarea custom field's contents in the Update Issue page (bug_update_page.php) allows an attacke
Yii 2: Local file inclusion via view parameter name collision
CVE-2026-39850
The core view rendering method `View::renderPhpFile()` calls `extract($_params_, EXTR_OVERWRITE)` before the `require` s
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
CVE-2026-34970
MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue. #
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API
CVE-2026-34754
### Impact MantisBT allows an authenticated user to upload attachments to private Issues they are not authorized to acce
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
CVE-2026-34744
MantisBT permits a user to list and download their own attachments from an Issue created by another user, even after tha
MantisBT has an authorization bypass in private issue monitoring
CVE-2026-34579
Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor fo
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
CVE-2026-34463
When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepen
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator
CVE-2026-34390
Insufficient access control checks in _ProjectUsersAddCommand_ (used in *manage_proj_user_add.php* and REST API endpoint
MantisBT Has Authorization Bypass in Global Profile Creation
CVE-2026-33052
MantisBT allows a low-privileged authenticated user having *add_profile_threshold* to create a global profile despite no
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
京公网安备 11000002002063号
该条情报来自360CERT安全报告，但提供的具体内容为空，无法提取任何攻击活动细节。标题为公安备案号，可能为错误输入。标签提及APT、报告、360和恶意软件，暗示可能涉及高级持续性威胁，但由于缺乏正文，无法确认任何技术细节、战术、受害者或影
（总）网出证（京）字第281号
输入数据为360网站版权信息页面，非威胁情报文章，无法提取相关攻击活动信息。
京网文〔2020〕6051-1195号
输入数据不完整或无效，标题“京网文〔2020〕6051-1195号”为互联网文化经营许可证号，并非威胁情报文章。来源为360CERT安全报告，但URL指向许可证页面，未提供有效正文。标签包含APT、报告、360、恶意软件，但缺乏实质性内容，
京ICP证080047号[京ICP备08010314号-6]
根据提供的输入，仅包含一个网站备案号标题（京ICP证080047号）和来源360CERT安全报告，但无实际内容摘要。无法确定任何攻击活动、威胁行为者或技术细节。疑似输入错误或无效情报。