CVE-2026-98199

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note...

https-nj.gov---CVE-2018-14042

https-nj.gov---CVE-2018-14042 뉴저지 공식 사이트의 취약점 보고서 Bootstrap 4.1.2 이전 버전에서는 메인 collapse data 속성에서 XSS가 가능합니다. data-target 속성, data-parent 속성 및 data-container 속성이 Cross-Site Scripting 공격에 취약합니다. Test 권장 사항 이 특정 문제에 대한 수정은 getTargetFromTrigger 함수를 변경하는 것입니다: return $target to: return...

CVE-2022-0441

在 WordPress 上的 MasterStudy LMS Plugin（WordPress 插件）2.7.5 及之前版本中发现了一个被归类为严重的漏洞。该漏洞影响 New Account Handler 组件的某个未知部分。对未知输入进行操纵会导致权限管理漏洞。该漏洞的 CWE 定义为 CWE-269。该软件未能正确地为参与者分配、修改、跟踪或检查权限，从而为该参与者创建了非预期的控制范围。已知其影响会危害机密性、完整性和可用性。 该弱点于 03/07/2022 以编号 2667195 披露。公告可在 wpscan.com 获取。该漏洞自 02/01/2022 起被命名为...

CVE-2020-36188

설명 FasterXML jackson-databind 2.x 버전 중 2.9.10.8 미만은 직렬화 가젯과 타이핑 간의 상호작용을 잘못 처리하며, 이는 com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource와 관련됩니다. RCE 방법 pom.xml com.fasterxml.jackson.core jackson-databind 2.9.10.7 com.newrelic.agent.java newrelic-agent 4.9.0 org.slf4j slf4j-nop 1.7...

CVE-2022-24734

CVE-2022-24734 PoC RCE는 MyBB의 관리자 제어판Admin CP에서 구성Configuration - 새 설정 추가Add New Setting에서 얻을 수 있습니다. 사용자는 설정을 추가하거나 업데이트할 권한이 있어야 합니다. 이는 MyBB 1.8.29에서 테스트되었습니다. 출처: https://github.com/mybb/mybb/ https://vulners.com/cve/CVE-2022-24734...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: gpio: aggregator: Protect driver attr handlers against module unload Both newdevicestore and deletedevicestore access module global resources e.g., gpioaggregatorlock. To prevent race conditions during module unloading, a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “spufs”: fixed a leak related to the failure of spufsnewfile. This issue is triggered from spufsfilldir, and the caller of that function will call spufsrmdir in case of failure. This action removes everything we’ve managed to...

Astra Linux – Vulnerability in binutils

In the GNU Binutils before version 2.40, there is a heap-buffer-overflow issue in the error function bfdgetl32 when called from the stripmain function in strip-new, through a specially crafted file...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: A fix was made to avoid using f2fsbugon in f2fsnewnodepage. As reported by Dipanjan Das , syzkaller discovered a bug in f2fs as follows: RIP: 0010:f2fsnewnodepage+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: writeallxattrs...

https-nj.gov---CVE-2018-14041

https-nj.gov---CVE-2018-14041 新泽西州官方网站的漏洞报告 data-target 属性容易受到跨站脚本（XSS）攻击。 Test 修复建议 针对此特定问题的修复方法可以是修改 getTargetFromTrigger 函数。 return $target 改为： return $document.querySelectortarget 但似乎其他地方也存在同样的问题。 以下是另一个示例： Test 参考资料...

CVE-2026-24061

🚨 CVE-2026-24061 — “TelneTD” GNU Inetutils telnetd의 치명적인 원격 인증 우회 2015년의 유령이 돌아와 여전히 텔넷을 실행 중인 모든 것을 장악합니다. 인증 제로. 환경 변수 하나. 즉시 루트 쉘. ⚠️ 개요 CVE-2026-24061 은 GNU Inetutils telnetd ≤ 2.7 에서 발견된 심각한 원격 권한 상승 취약점입니다. 인증되지 않은 원격 공격자는 Telnet NEW-ENVIRON 옵션을 통해 USER 환경 변수를 "-f root"로 설정합니다. telnetd는 이를...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3は、クロスサイトスクリプティング（XSS）に対して脆弱です。攻撃者は「Add New Entry」セクションに悪意のあるJavaScriptコードを注入することができ、被害者のウェブブラウザのコンテキストで任意のコードを実行できるようになります。 脆弱性の種類: クロスサイトスクリプティング（XSS） 製品ベンダー : flatpress CMS 影響を受ける製品コードベース : Flatpress v1.3 - FlatPressバージョン1.3で修正される予定です。 影響を受けるコンポーネント 管理パネルの「Add New...

PT-2026-104610

Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.7 Description The plugin fails to scope its REST API authentication filter to its own endpoints. This action disables the REST nonce protection provided by WordPress core for every route...

PT-2026-104328

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is...

SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2026:4402-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4402-1 advisory. - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

PYSEC-2026-4059 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

EUVD-2026-89337

JupyterLab: Cross-site scripting XSS in JupyterLab via crafted language package jupyterlab.json...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...