Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Mul...

CVE-2026-48598

Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via u

历史摘要 · 未重新核验 · NVD

An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site script...

CVE-2026-48209

An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authe

历史摘要 · 未重新核验 · NVD

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, a...

CVE-2026-44713

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the

历史摘要 · 未重新核验 · NVD

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping t...

CVE-2026-45570

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH t

历史摘要 · 未重新核验 · NVD

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in ...

CVE-2026-44972

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled f

历史摘要 · 未重新核验 · NVD

CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

CVE-2026-44587

### Summary CarrierWave's content_type_denylist check fails to escape regex metacharacters in string entries, causing th

历史摘要 · 未重新核验 · GitHub Advisory

CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS

CVE-2026-26028

### Summary CryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags. B

历史摘要 · 未重新核验 · GitHub Advisory

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

CVE-2026-46637

### Description Several filters in the `twig/*` extras packages are registered with `is_safe => ['all']`, which tells T

历史摘要 · 未重新核验 · GitHub Advisory

Twig: The `spaceless` filter implicitly marks its output as safe

CVE-2026-46628

### Description The `spaceless` filter is registered with `is_safe => ['html']`, which means Twig's autoescaper does no

历史摘要 · 未重新核验 · GitHub Advisory

CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incomplete attribute fi...

CVE-2026-26028

CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Dif

历史摘要 · 未重新核验 · NVD

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in the admin role mana...

CVE-2026-34246

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Sc

历史摘要 · 未重新核验 · NVD

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/h...

CVE-2026-44429

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the

历史摘要 · 未重新核验 · NVD

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) renders the name and version fields of a package's plugin....

CVE-2026-45375

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) r

历史摘要 · 未重新核验 · NVD

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and pa...

CVE-2026-44588

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/

历史摘要 · 未重新核验 · NVD

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not f...

CVE-2026-44458

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer

历史摘要 · 未重新核验 · NVD

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

CVE-2026-45375

### Summary SiYuan's Bazaar (community marketplace) renders the `name` and `version` fields of a package's `plugin.json

历史摘要 · 未重新核验 · GitHub Advisory

Hono has CSS Declaration Injection via Style Object Values in JSX SSR

CVE-2026-44458

### Summary The JSX renderer escapes `style` attribute object values for HTML but not for CSS. Untrusted input in a `st

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

CVE-2026-44588

## Summary The tooltip mouseover handler in `app/src/block/popover.ts` reads `aria-label` via `getAttribute` and passes

历史摘要 · 未重新核验 · GitHub Advisory

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

## Summary The public RSS/Atom feed at `/rss` renders two attacker-controlled surfaces without HTML escaping. Tag names

历史摘要 · 未重新核验 · GitHub Advisory

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

CVE-2026-43939

**Description:** Stored Cross-Site Scripting (XSS) occurs when user-supplied input is persisted by the application and l

历史摘要 · 未重新核验 · GitHub Advisory