An improper neutralization of input during web page generation ('Cross-site Scripting')...
CVE-2026-9548
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain
#severity:medium
共收录 5482 条相关情报。
← 返回所有主题aiosmtplib: STARTTLS response injection
CVE-2026-55558
## Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
CVE-2026-54770
## Summary This is a third follow-up to **CVE-2024-42353 / GHSA-mg3v-6m49-jhp3** and **CVE-2026-44889 / GHSA-fh3h-vg37-
libreoffice-convert vulnerable to path traversal / arbitrary file write
CVE-2026-54732
### Impact options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-suppli
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
CVE-2026-54687
## Affected versions < 1.0.0 ## Patched version 1.0.0 ## Description In versions prior to 1.0.0, the SQLite node accep
Silverstripe Framework: Possible XSS attack through media embed
CVE-2026-54720
### Impact The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. ##
Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish...
CVE-2026-77034
Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla...
CVE-2026-77989
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - bui
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged...
CVE-2026-77035
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Eve
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in...
CVE-2026-77990
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.
Spring Cloud Config Server native environment repository allows exposure of configuration files...
CVE-2026-47894
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configure
The UnZipTransformer does not limit decompressed entry size or entry count when processing...
CVE-2026-59274
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an at
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just...
CVE-2026-59275
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — fu
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted...
CVE-2026-59278
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these m
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in...
CVE-2026-59271
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer...
CVE-2026-47875
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deser
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple...
CVE-2026-47881
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for examp
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java...
CVE-2026-47864
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and
A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound...
CVE-2026-47880
A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes...
CVE-2026-47878
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes di