A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME e…

▾ TwilightRed Hat · cri-oEPSS 0.18%via NVD

CVE-2026-50659Medium· 6.5

2mo ago

.NET Spoofing Vulnerability

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

▾ SunlitMicrosoft · .NET 10.0EPSS 0.74%via CVEORG

CVE-2026-45710Low· 3.5

2mo ago

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

▾ Sunlitfacturascripts · facturascripts/facturascriptsvia GHSA

CVE-2026-49844Medium· 6.3PoC

2mo ago

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.…

▾ TwilightApache Software Foundation · org.apache.logging.log4j:log4j-apiEPSS 0.81%via NVD

CVE-2026-55659High· 7.7

2mo ago

Grist is spreadsheet software using Python as its formula language

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-si…

▾ TwilightEPSS 0.36%via NVD

GHSA-cwv4-h3j5-w3cfLow· 3.7

2mo ago

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

▾ Sunlitrama · ramavia GHSA

CVE-2026-54893Low· 2.1

2mo ago

URL path injection in the Microsoft Graph adapter of Swoosh

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encodi…

▾ Sunlitswoosh · swooshEPSS 0.20%via NVD

CVE-2026-35346Low· 3.3

2mo ago

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

▾ Sunlituu_comm · uu_commEPSS 0.17%via GHSA

CVE-2026-35366Medium· 4.4

CWE-116

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

A flaw was found in CRI-O

.NET Spoofing Vulnerability

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Grist is spreadsheet software using Python as its formula language

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

URL path injection in the Microsoft Graph adapter of Swoosh

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

justhtml: to_markdown() code-span blank-line breakout enables XSS

Duplicate Advisory: ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands

Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths

HTML injection in pgAdmin 4's cloud deployment module

OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

Heimdall: IP Spoofing via Unvalidated Forwarding Headers

Laravel Framework: Temporary Signed URL Path Confusion

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

Caddy: stripHTML template function bypass

jmespath.php: jmespath.php has CompilerRuntime code injection via unescaped function names (CVE-2026-54133)

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)