118902 matches found
CVE-2026-86244 FastAdmin User Controller User.php login cross site scripting
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...
PT-2026-86595
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401 beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...
PT-2026-86875
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
PT-2026-86853
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...
CVE-2026-86503: Server-Side Request Forgery (SSRF)
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
CVE-2026-86244: Improper Neutralization of Input During Web Page Generation
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...
CVE-2026-86481: Authorization Bypass Through User-Controlled Key
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...
CVE-2026-86440: Improper Neutralization of Input During Web Page Generation
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MIS...
CVE-2026-86351: URL Redirection to Untrusted Site
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...
PT-2026-86770
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MIS...
PT-2026-86834
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible t...
PT-2026-86679
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...
PT-2026-86583
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test default model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base url results in server-side request forgery. The attack may be initiat...
ROS-20260907-73-0061
The vulnerability in Erlang relates to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL address...
grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal
A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...
grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal
A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...
SUSE-SU-2026:23499-1 Security update for NetworkManager
This update for NetworkManager fixes the following issues: - CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation...
SUSE-SU-2026:23635-1 Security update for php-composer2
This update for php-composer2 fixes the following issue: - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257...
OPENSUSE-SU-2026:21778-1 Security update for php-composer2
This update for php-composer2 fixes the following issue: - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257...
CVE-2026-86259
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...