Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getA...

CVE-2026-106102

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getH

历史摘要 · 未重新核验 · NVD

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

CVE-2026-105801

### Impact A malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary

历史摘要 · 未重新核验 · GitHub Advisory

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before render...

CVE-2026-105801

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely ne

历史摘要 · 未重新核验 · NVD

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

### Summary: 5 findings — `BashTool` shell-injection sink (F6, the canonical RCE primitive), `BackgroundRunTool` async

历史摘要 · 未重新核验 · GitHub Advisory

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identi...

CVE-2026-104907

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP s

历史摘要 · 未重新核验 · NVD

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary ...

CVE-2026-95274

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromis

历史摘要 · 未重新核验 · NVD

fast-uri vulnerable to authority injection via an unvalidated port in serialize

CVE-2026-84292

### Impact `fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `

历史摘要 · 未重新核验 · GitHub Advisory

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

CVE-2026-88058

### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serializat

历史摘要 · 未重新核验 · GitHub Advisory

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

CVE-2026-61784

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString()

历史摘要 · 未重新核验 · GitHub Advisory

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

CVE-2026-82409

**Component:** Elasticsearch indexer (`indexer/`) **Primary location:** `indexer/common.go:2395-2407` (`serializedDataFo

历史摘要 · 未重新核验 · GitHub Advisory

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name ...

CVE-2026-82409

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataF

历史摘要 · 未重新核验 · NVD

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

CVE-2026-82409

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataF

历史摘要 · 未重新核验 · OSV.dev

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from th...

CVE-2026-95659

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. T

历史摘要 · 未重新核验 · NVD

MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

CVE-2026-95659

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. T

历史摘要 · 未重新核验 · OSV.dev

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-...

CVE-2026-63329

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate

历史摘要 · 未重新核验 · NVD

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows r...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-6905

历史摘要 · 未重新核验 · NVD

An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allo...

CVE-2026-13635

An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-

历史摘要 · 未重新核验 · NVD

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] f...

CVE-2026-54506

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5

历史摘要 · 未重新核验 · NVD

djust: A template binding inherits a context safety grant it never earned (XSS)

A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had ma

历史摘要 · 未重新核验 · GitHub Advisory

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup

历史摘要 · 未重新核验 · GitHub Advisory