malla: Stored XSS via Meshtastic node names in multiple frontend pages
CVE-2026-43980
Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM
#severity:medium
共收录 5584 条相关情报。
← 返回所有主题quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
CVE-2026-40898
## Summary An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by s
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
CVE-2026-40181
Certain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
CVE-2026-34993
### Summary Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. ### Impact Most appli
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
CVE-2026-33244
When using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
CVE-2022-31114
### Impact It’s a “*moderate*” vulnerability… but being an admin panel, take this seriously. It’s difficult… but an att
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of...
CVE-2026-36605
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low numb
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an...
CVE-2026-20233
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote at
A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature...
CVE-2026-39107
A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized...
CVE-2026-36613
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents whe
A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this...
CVE-2026-10704
A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the func
A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this...
CVE-2026-10694
A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function i
The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to...
CVE-2026-9732
The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forger
The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all...
CVE-2026-7421
The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu
Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on...
CVE-2026-10718
Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function...
CVE-2026-10650
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of t
A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown...
CVE-2026-10620
A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription...
CVE-2026-49120
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authen
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0'...
CVE-2026-5074
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_priv
Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to...
CVE-2026-8035
Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service