612 matches found
Astra Linux – Vulnerability in node-minimist
Minimist =1.2.5 is vulnerable to Prototype Pollution through the file index.js, the function setKey lines 69-95...
CVE-2026-81771
Unauthenticated Cross Site Scripting XSS in TrustedSite = 1.2.5 versions...
PT-2026-84690
Name of the Vulnerable Software and Affected Versions TrustedSite versions prior to 1.2.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update TrustedSite to a version...
EUVD-2026-62481
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the apivedo/chat endpoint and the utentechat parameter...
CVE-2026-70559 Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll
Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...
CVE-2026-70559
Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...
CVE-2026-70559
Summary: Dinky v1.2.5 (and dev head) exposes an unauthenticated GET endpoint, /api/sysConfig/getAll, due to a method-level @SaIgnore bypassing class-level login checks. An unauthenticated remote user can retrieve the full live system configuration (54 entries on stock v1.2.5) with minimal GET. Th...
CVE-2026-70558
Dinky CVE-2026-70558 affects the v1.2.5 release and development branch. The vulnerable component is the POST /download/uploadFromRsByLocal handler, which passes a caller-supplied path directly to new File(path) and file.transferTo(dest) with no path validation. The route is SaIgnore’d and /downlo...
OPENSUSE-SU-2026:11417-1 libntpc1-1.2.5-1.1 on GA media
These are all security issues fixed in the libntpc1-1.2.5-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-65527
Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...
CVE-2026-65527
The CVE-2026-65527 entry covers a Cross Site Scripting (XSS) vulnerability in the WordPress LIQUID SPEECH BALLOON plugin, affected versions
EUVD-2026-48128
Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...
CVE-2026-65527
Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...
CVE-2026-65527 WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...
PT-2026-63938
Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
ImpactArbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows.Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax: - \ — the Windows path separator...
PT-2026-59133
Impact An uncontrolled-resource-consumption memory exhaustion denial-of-service vulnerability CWE-400 / CWE-789. A client with push access could push a tiny crafted thin pack 174 bytes whose delta header declares a huge dest size. When dulwich ingested it via add thin pack / apply delta, it would...
CVE-2026-13236
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1...