Copyparty vulnerable to eflected cross-site scripting via setck parameter

9001 copyparty 9001 copyparty

OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership

openemr openemr open-emr openemr

Custom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting

tgrk Custom Logo

Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes

livemesh Livemesh Addons for Beaver Builder

TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea

readymadeweb TP2WP Importer

WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings

bulktheme WP Social Meta

WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src

stuartbates WP Responsive Images

EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'

motahar1 EM Cost Calculator

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

NaturalIntelligence fast-xml-parser fast-xml-parser_project fast-xml-parser +1个

OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

openlit openlit

WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

wp-graphql wp-graphql

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

isaacs minimatch isaacs minimatch +7个

minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

isaacs minimatch isaacs minimatch +7个

Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

sveltejs svelte

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

sveltejs svelte

Spin has memory leaks in various WIT interfaces

spinframework spin spinframework SpinKube +1个

Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure

linode terraform-provider-linode

sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

Bitnami sealed-secrets

WireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update

h44z wg-portal wgportal wireguard_portal

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

modelcontextprotocol go-sdk