368795 matches found
NPM: Ghost: Server-Side Request Forgery in Webhook Trigger
NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...
CVE-2026-107272
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...
CVE-2026-107206
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...
DEBIAN-CVE-2026-106574
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...
CVE-2026-106574
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...
DEBIAN-CVE-2026-106570
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...
CVE-2026-106570
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...
CVE-2026-106570
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...
UBUNTU-CVE-2026-106570
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...
UBUNTU-CVE-2026-106574
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...
CVE-2026-106574
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...
Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...
Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty ar...
NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server vulnerability discovered by ? in WordPress Npm quasar versions = 2.23.2...
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...
EUVD-2026-94521
PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...
org.apache.jackrabbit:jackrabbit-standalone-components (>=2.22.0, <=2.22.4), org.apache.jackrabbit:jackrabbit-webapp (>=2.22.0, <=2.22.4) +5 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-jcr-server (>=2.22.0, <=2.22.4)
org.apache.jackrabbit:jackrabbit-jcr-server MAVEN version =2.22.0, =2.22.0, =2.22.0, =1.66.0, =3.0.0-beta2, =4.1.0 Source cves: CVE-2026-92414 Source advisory: MEND:CVE-2026-92414...
org.apache.jackrabbit:jackrabbit-standalone-components (>=2.23.0-beta, <=2.23.5-beta), org.apache.jackrabbit:jackrabbit-webapp (>=2.23.0-beta, <=2.23.5-beta) potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-jcr-server (>=2.23.0-beta, <=2.23.5-beta)
org.apache.jackrabbit:jackrabbit-jcr-server MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.5-beta Source cves: CVE-2026-92414 Source advisory: MEND:CVE-2026-92414...
EUVD-2026-94403
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...
CVE-2026-107272 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...