124165 matches found
CVE-2026-44757: Improper Neutralization of Input During Web Page Generation
SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the...
PT-2026-47539
SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the...
CVE-2026-6445: Improper Authorization in Handler for Custom URL Scheme
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges...
CVE-2026-48289: Improper Input Validation
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...
cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache
cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache...
PT-2026-79057
Name of the Vulnerable Software and Affected Versions WebOb versions prior to 1.8.11 Description An issue exists where the Response. make location absolute function in src/webob/response.py performs checks for a URI scheme or leading double slashes before urllib.parse.urljoin removes leading C0...
PT-2026-47722
Name of the Vulnerable Software and Affected Versions Slider Revolution versions prior to 7.0.11 Description The plugin is subject to sensitive information disclosure resulting from three design flaws. First, a valid backend AJAX nonce revslider actions is leaked to all authenticated users,...
PT-2026-48267
OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that...
TYPO3 CMS input validation vulnerability
TYPO3 CMS is a content management system developed under the TYPO3 open source framework. There is a vulnerability in input validation of TYPO3 CMS, which stems from the GeneralUtility::sanitizeLocalUrl function. This function allows URLs to be used for redirection even after cleaning, potentiall...
CVE-2026-47347: URL Redirection to Untrusted Site
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This...
PT-2026-47740
Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.50 TYPO3 CMS versions 12.0.0 through 12.4.45 TYPO3 CMS versions 13.0.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2 Description Applications utilizing the...
EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-2245)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a...
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Summary An unauthenticated attacker Alice connects to FUXA's Socket.IO endpoint and emits a device-webapi-request event whose property.address field names an arbitrary URL. FUXA's DEVICEWEBAPIREQUEST handler at server/runtime/index.js:296 calls axios.getaddress server-side and broadcasts the full...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the Insert and Update processes in the browser plugin components, where user-supplied input is interpolated directly into AppleScript or JXA templates without proper escaping. An attacker can execute arbitra...
PHPSpreadsheet has a patch bypass for CVE-2026-34084
Summary CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parseurl$filename, PHPURLSCHEME and then checks isstring$scheme && strlen$scheme 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path conta...
CVE-2026-11582
creationtimestamp| type| source ---|---|--- 2026-06-08 21:43:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsnmjzlmj2q 2026-06-08 22:28:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mnsq2m4kgj2f...
CVE-2026-47345
creationtimestamp| type| source ---|---|--- 2026-06-08 20:57:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsl3enfz62j...
CVE-2026-44541
fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridden valu...
CVE-2026-39910
creationtimestamp| type| source ---|---|--- 2026-06-08 19:43:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsgt6ropt23 2026-06-22 01:02:05+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motoshdiat2m...
CVE-2026-11685
creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 00:43:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsxpmsg252p 2026-06-15 18:00:00+00:00| seen|...