CVE-2026-55094

Publié : 30 septembre 2026

Modifié : 30 septembre 2026

Description détaillée

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.

Références et Patchs

https://bugzilla.mozilla.org/show_bug.cgi?id=2045091 https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b https://github.com/taskcluster/taskcluster/issues/8716 https://github.com/taskcluster/taskcluster/pull/8718 https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0 https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38

Dernières Vulnérabilités

CVE-2026-97291

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.

VOIR DÉTAILS

CVE-2026-97290

Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.

VOIR DÉTAILS

CVE-2026-97265

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

VOIR DÉTAILS