#cwe-116

共收录 223 条相关情报。

漏洞预警2026-10-20 发布INFO

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes ba...

CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escap

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-116

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA ...

CVE-2026-113667

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-rec

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-10-20 发布INFO

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that ...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-306

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(),...

CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-41 #cwe-116

安全公告2026-10-19 发布INFO

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

CVE-2026-111059

## Summary Mercury turns Jupyter notebooks into shared web apps/dashboards. The `mr.Markdown` widget converts its input

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-116 #severity:medium

安全公告2026-10-16 发布INFO

swoosh has email-derived URL path injection in Microsoft Graph endpoint

CVE-2026-54893

### Summary `Swoosh.Adapters.MsGraph` builds its Microsoft Graph API request URL by interpolating the sender's email ad

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #erlang #cwe-116 #cwe-789 #cwe-1284 #severity:low

安全公告2026-10-15 发布INFO

Vitess vttablet /twopcz reflected XSS

CVE-2026-104252

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-79 #cwe-80 #cwe-116 #severity:critical

安全公告2026-10-15 发布INFO

unstructured: Stored XSS via unescaped HTML generation

CVE-2026-104250

### Summary When `unstructured` parses an untrusted document and outputs the result as HTML, malicious markup contained

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-116 #severity:medium

漏洞预警2026-10-13 发布INFO

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24....

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, suc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

安全公告2026-10-13 发布INFO

unstructured: Stored XSS via unescaped HTML generation

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, suc

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-79

漏洞预警2026-10-12 发布INFO

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insu...

CVE-2026-93693

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations a

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-116 #cwe-306 #cwe-918

安全公告2026-10-09 发布INFO

Contao: Cross-site scripting in the comments bundle

CVE-2026-107845

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-79 #cwe-116 #severity:critical

漏洞预警2026-10-09 发布INFO

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without suf...

CVE-2026-107845

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a commen

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-10-09 发布INFO

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safel...

CVE-2026-107823

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-116 #cwe-144

安全公告2026-10-09 发布INFO

MariaDB: privilege escalation via incorrect view frm parsing

CVE-2026-107823

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-144

安全公告2026-10-07 发布INFO

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

CVE-2026-61439

### Summary Injection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detecti

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-116 #cwe-693 #cwe-1287 #severity:high

安全公告2026-10-06 发布INFO

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache...

CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character ou

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-116 #severity:medium

漏洞预警2026-10-06 发布INFO

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/co...

CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.preco

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-10-06 发布INFO

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record...

CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character ou

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-10-06 发布INFO

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContex...

CVE-2026-106107

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116