StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
CVE-2026-55691
### Summary The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote t
#severity:high
共收录 5499 条相关情报。
← 返回所有主题StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
CVE-2026-55690
### Summary When passing an unknown service name to embedvideo, an error message is rendered containing the invalid serv
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
CVE-2026-55091
### Summary `convert()` builds the nested tree by using each flat record's `id` and `parent` field values directly as
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
CVE-2026-55849
## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--wo
Blocky DNSSEC validation bypass and validation-cache scope pollution
## Summary Blocky accepts and caches forged DNS answers while `dnssec.validate: true` is enabled. The issue has two rel
Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric...
CVE-2026-8805
Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-E
Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP...
CVE-2026-8806
Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET
An attacker within BLE communication range can passively intercept wireless traffic and obtain...
CVE-2026-50034
An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related
An attacker within BLE communication range can monopolize the device's only available BLE...
CVE-2026-52866
An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing l
PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger...
CVE-2026-56077
PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows
Impact A security issue has been identified in Chef 360 that could allow unauthorized access to...
CVE-2026-8100
Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints
SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '...
CVE-2026-12044
SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS ''`` for a user-supplied descri
PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI...
CVE-2026-56075
PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode appro
PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails...
CVE-2026-56078
PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs w
Exposure of sensitive information to an unauthorized actor in Cost Management Interactive...
CVE-2026-47633
Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthor
PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI...
CVE-2026-56076
PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote a
Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges...
CVE-2026-32174
Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read...
CVE-2025-15661
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink()
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that...
CVE-2026-25865
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to e
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited...
CVE-2026-12390
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using spe