#cwe-87

共收录 11 条相关情报。

漏洞预警2026-07-09 发布INFO

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize(), Sane::sanitize()...

CVE-2026-54002

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-87

安全公告2026-07-09 发布INFO

Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

CVE-2026-54002

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79 #cwe-87

安全公告2026-07-07 发布INFO

Open WebUI allows limited stored XSS vila uploaded html file

CVE-2025-46571

### Summary Low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend en

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-87 #severity:medium

漏洞预警2026-07-01 发布INFO

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitiz...

CVE-2026-55661

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text par

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-87

漏洞预警2026-06-18 发布INFO

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site S...

CVE-2026-55237

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

历史摘要 · 未重新核验 · NVD

#cve #cwe-87 #cwe-601

漏洞预警2026-06-09 发布INFO

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown r...

CVE-2026-46492

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (

历史摘要 · 未重新核验 · NVD

#cve #cwe-80 #cwe-87

漏洞预警2026-06-09 发布INFO

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in ...

CVE-2026-25688

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-87

漏洞预警2026-05-15 发布MEDIUM

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profi...

CVE-2026-45314

Open WebUI 是一个自托管的人工智能平台，设计为完全离线运行。在版本 0.9.3 之前，其频道 webhook 创建/更新流程接受任意的 profile_image_url 值，包括 data:image/svg+xml;base6

历史摘要 · 未重新核验 · NVD

#cve #cwe-87

漏洞预警2026-05-15 发布INFO

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of back...

CVE-2026-42458

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

历史摘要 · 未重新核验 · NVD

#cve #cwe-87

漏洞预警2026-05-04 发布INFO

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with ...

CVE-2026-42235

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-87

安全公告2026-04-29 发布INFO

n8n Vulnerable to XSS via MCP OAuth client

CVE-2026-42235

## Impact An unauthenticated attacker could register a malicious MCP OAuth client with a crafted `client_name`. If a vic

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-87 #severity:high