All CVEs — page 407 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A SQL injection vulnerability in MediaWiki's UserPageViewTracker extension allows attackers to execute arbitrary SQL commands against the database. This could lead to unauthorized data access and potential database compromise.
The flaw allows attackers to execute additional shell commands by exploiting prompt injection in the experimental agent mode Bash tool approval mechanism, bypassing session approval requirements.
The flaw allows an untrusted guest content to enable nodeIntegrationInWorker for Web Workers, potentially gaining more privileges than intended by the embedder.
The flaw allows untrusted content in a sandboxed top-level document to open a window with the Electron application's full origin, bypassing intended sandbox restrictions.
The flaw allows untrusted iframes to open popups with the embedding application's full origin, exposing cookies, storage, and scripting capabilities.
SGLang's prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests, allowing unauthenticated attackers to crash scheduler processes or hang other requests by sending concurrent requests with identical bootstrap_room values.