https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 14:13:51 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-93432 <p>A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template&#39;s content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user&#39;s browser or manipulate data.</p> <p>A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template&#39;s content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user&#39;s browser or manipulate data.</p> https://db.gcve.eu/vuln/fkie_cve-2026-93432 https://db.gcve.eu/vuln/ghsa-6wxq-x76c-fqrf <p>A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template&#39;s content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user&#39;s browser or manipulate data.</p> <p>A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template&#39;s content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user&#39;s browser or manipulate data.</p> https://db.gcve.eu/vuln/ghsa-6wxq-x76c-fqrf https://db.gcve.eu/vuln/rhsa-2026:83082 <p>com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch io.micrometer/micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing lz4-java: lz4-java: Denial of Service via insufficient validation in XXHash JNI implementations com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation org.apache.freemarker/freemarker: Apache FreeMa…</p> <p>com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch io.micrometer/micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing lz4-java: lz4-java: Denial of Service via insufficient validation in XXHash JNI implementations com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation org.apache.freemarker/freemarker: Apache FreeMa…</p> https://db.gcve.eu/vuln/rhsa-2026:83082