122885 matches found
CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
EUVD-2026-48311
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697
Fathom Lite (v1.3.1) has a stored XSS in the analytics collection endpoint (/collect). An unauthenticated user can supply crafted hostname and pathname to inject a javascript: URI, since parseHostname/parsePathname perform no URI scheme validation. The payload is stored and later rendered as an a...
CVE-2026-48534
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...
Directory Traversal
Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the process function. An attacker can access arbitrary files and obtain the first 10 bytes of their contents by supplying a crafted...
NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.11...
CVE-2026-65687
creationtimestamp| type| source ---|---|--- 2026-07-23 15:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd472v7uj2j 2026-07-23 17:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvfs6bk2m 2026-07-29 22:37:06+00:00| seen|...
CVE-2026-64813
creationtimestamp| type| source ---|---|--- 2026-07-23 14:58:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd3xvfemu2e 2026-07-29 03:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrqx232sos2y...
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...
CVE-2026-61949
creationtimestamp| type| source ---|---|--- 2026-07-23 13:06:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvpn7bac2s...
CVE-2026-59526
creationtimestamp| type| source ---|---|--- 2026-07-23 13:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvevrzyn2e 2026-08-12 22:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msw5rlakev2c...
CVE-2026-59514
creationtimestamp| type| source ---|---|--- 2026-07-23 12:58:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvbd3cpb2u...
CVE-2026-64142
creationtimestamp| type| source ---|---|--- 2026-07-23 12:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcrzkrruz2k 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...
CVE-2026-64132
creationtimestamp| type| source ---|---|--- 2026-07-23 11:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcrsftlaf23 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...
CVE-2026-60834
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrraokts2b 2026-07-23 17:47:49+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-60158
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...
CVE-2026-60159
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:47:04+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-47055
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...