122405 matches found
PT-2026-68599
Name of the Vulnerable Software and Affected Versions Subscribe to Comments versions prior to 2.3.2 Description An Author Cross Site Scripting XSS issue exists in the Subscribe to Comments plugin. Cross Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages...
CVE-2026-47185: Incorrect Authorization
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...
PT-2026-68732
Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.18.0 Description The Workspace Save API endpoint accepts a workspace identifier from any authenticated user without verifying workspace ownership. This allows an attacker to modify private workspaces belonging to...
EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-2998)
According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...
PT-2026-68402
Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.6.4 Description The AI Engine WordPress plugin fails to redact secret configuration values before exposing them within an admin page's inline script data. This allows users with the Editor role to access the site'...
EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-3048)
According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...
PT-2026-68812
Name of the Vulnerable Software and Affected Versions league/commonmark versions 1.5.0 through 2.8.3 Description The AttributesExtension in the library contains a flaw where the href and src unsafe-link filters can be bypassed. This occurs because the filterAttributes function and the...
EulerOS 2.0 SP13 : golang (EulerOS-SA-2026-3017)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 If a trusted template...
Malicious code in @chnayser/server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdabed9cce6fadeadd8cdbed43b435030ae2e1807a6b13b2815ac6389cfd1c65 The package's Express server started via the advertised startServer/createApp entry points mounts a GET route at /api/update whose handler executes...
MAL-2026-13374 Malicious code in @chnayser/server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdabed9cce6fadeadd8cdbed43b435030ae2e1807a6b13b2815ac6389cfd1c65 The package's Express server started via the advertised startServer/createApp entry points mounts a GET route at /api/update whose handler executes...
MAL-2026-13377 Malicious code in ezdiscordbots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921 package.json declares a postinstall script sudo node install.js that runs install.js with root privileges on the installer's machine. Both install.js...
MAL-2026-13378 Malicious code in npm-dc-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723 package.json declares "postinstall": "node test.js". test.js top-level require'.'s index.js and awaits an exported fromstr. index.js consists of a...
Exploit for CVE-2026-42533
CVE-2026-42533 Pre-auth heap buffer overflow and heap informa...
CVE-2026-70431
Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...
MAL-2026-13366 Malicious code in @workoscalif/sudoku (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...
CVE-2026-70441
Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...
CVE-2026-70431
Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...
CVE-2026-70431
The Jenkins Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier are vulnerable to arbitrary code execution. The root cause is that the plugin provides Groovy scripting features that do not integrate with the Script Security Plugin , failing to enforce necessary sandboxing. An attacker posses...
CVE-2026-70431
Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...
EUVD-2026-53525
Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...