Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 01:22:59 +0000 CERTFR-2025-AVI-0106 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… https://vulnerability.circl.lu/vuln/CERTFR-2025-AVI-0106 CERTFR-2025-AVI-0106 https://vulnerability.circl.lu/vuln/CERTFR-2025-AVI-0106 bdu:2024-04404 https://vulnerability.circl.lu/vuln/bdu:2024-04404 bdu:2024-04404 https://vulnerability.circl.lu/vuln/bdu:2024-04404 fkie_cve-2024-36361 https://vulnerability.circl.lu/vuln/fkie_cve-2024-36361 <p>Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.</p> <p>Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2024-36361 GHSA-3965-hpx2-q597 — Pug allows JavaScript code execution if an application accepts untrusted input https://vulnerability.circl.lu/vuln/ghsa-3965-hpx2-q597 <p><strong>Affected:</strong> npm: pug-code-gen, npm: pug</p> <p>Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the `compileClient`, `compileFileClient`, or `compileClientWithDependenciesTracked` function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.</p> <p><strong>Affected:</strong> npm: pug-code-gen, npm: pug</p> <p>Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the `compileClient`, `compileFileClient`, or `compileClientWithDependenciesTracked` function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.</p> https://vulnerability.circl.lu/vuln/ghsa-3965-hpx2-q597