XSS in Ghost's ActivityPub client
CVE-2026-53950
### Impact The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously cust
#severity:high
共收录 5387 条相关情报。
← 返回所有主题A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of...
CVE-2026-18812
A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Ex
A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of...
CVE-2026-18811
A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Perfo
A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file...
CVE-2026-18813
A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipul
An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a...
CVE-2026-18657
An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated ac
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity...
CVE-2026-16792
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 micr
An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a...
CVE-2026-18656
An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated a
An improper neutralization of special elements used in an operating system command vulnerability...
CVE-2026-16793
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo
Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database...
CVE-2026-69704
Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsan
SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that...
CVE-2026-69702
SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated a
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
CVE-2026-70494
## Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
CVE-2026-70492
## Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow inste
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
CVE-2026-70486
## Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
CVE-2026-70485
## Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and we
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
CVE-2026-70482
## Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provid
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
CVE-2026-70479
## Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
CVE-2026-70476
### Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) withou
Flowise: Missing Authorization on Execution Update Endpoint
CVE-2026-70475
# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: h
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of...
CVE-2026-47623
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A succ
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an...
CVE-2026-24255
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash