Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
CVE-2026-93421
### Summary The `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to st
#advisory
共收录 23334 条相关情报。
← 返回所有主题Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
CVE-2026-93421
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /_
s2s-proxy accepts untrusted client certificates
CVE-2026-96770
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
CVE-2026-77602
### Summary COSMOS reads configuration from a user-writable overlay (`targets_modified/`) before the read-only plugin-i
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
CVE-2026-77602
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
CVE-2026-77394
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
CVE-2026-77601
## Summary An authenticated user can execute arbitrary operating system commands on the `openc3-cosmos-cmd-tlm-api` serv
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
CVE-2026-77601
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
CVE-2026-61695
### Summary Wire's Swift runtime (`Wire` SPM/CocoaPods product, implemented by `wire-runtime-swift`) did not reject a n
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
CVE-2026-61695
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's S
Jawn: Uncontrolled nesting depth in JSON parser
CVE-2026-59990
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nes
Jawn: Quadratic parsing effort in AsyncParser
CVE-2026-61814
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON tok
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
CVE-2026-76087
### Impact The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
CVE-2026-76087
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
CVE-2026-76086
### Impact The control panel action `formie/integrations/form-settings` (`IntegrationsController::actionFormSettings`)
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
CVE-2026-76086
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings
Formie: Missing authorization on sent notification resend modal exposes submission PII
CVE-2026-76089
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
CVE-2026-92692
### Impact An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query b
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
CVE-2026-92692
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affe
JLine: ReDoS in Built-in Less Viewer Search
CVE-2026-77423
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer p