JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` bu
#cwe-116
共收录 223 条相关情报。
← 返回所有主题Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
CVE-2026-64647
## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to t
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
CVE-2026-59727
### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a cl
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
CVE-2026-50659
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL...
CVE-2026-63397
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed t
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The...
CVE-2026-63397
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed t
remorses/genql code injection
CVE-2026-63397
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed t
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables o...
CVE-2026-15809
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypasse
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to trea...
CVE-2026-46637
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra a
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled marku...
CVE-2026-46628
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, ca
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
CVE-2026-46637
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra a
Twig: The `spaceless` filter implicitly marks its output as safe
CVE-2026-46628
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, ca
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2026-50659
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. Exploita...
CVE-2026-48358
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary co
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first...
CVE-2026-62184
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to...
CVE-2026-62184
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses...
CVE-2026-58487
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe
HedgeDoc: Stored HTML injection via email local-part
CVE-2026-58487
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe
luci-app-banip Log Monitor IP Extraction Bypass
CVE-2026-62184
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in...
CVE-2026-49844
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces