MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
CVE-2026-85230
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widge
#cwe-20
共收录 1723 条相关情报。
← 返回所有主题n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated u...
CVE-2026-85170
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail comp
n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
CVE-2026-85170
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail comp
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggreg...
CVE-2026-49830
DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver
DSpace: ORE resource URI does not validate scheme for non-web resources
CVE-2026-49830
DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension heade...
CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffe
async-tar PAX extension-header desync enables tar entry/content smuggling
CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffe
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
CVE-2026-75975
### Impact `fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed liter
Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.
CVE-2026-76758
Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote...
CVE-2026-84357
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a...
CVE-2026-84325
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging s
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted netw...
CVE-2026-84357
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions vi...
CVE-2026-84325
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging s
A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution o...
CVE-2026-73768
A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid in...
CVE-2026-82740
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nest
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attrib...
CVE-2026-82738
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by
Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82740
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nest
Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
CVE-2026-82738
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controlle...
CVE-2026-82732
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values
Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82732
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values