CVE-2026-77614: Session Fixation

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mhdefaultorg.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does no...

CVE-2026-15810: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-30862: Improper Neutralization of Input During Web Page Generation

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget TableWidgetV2. The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be...

CVE-2025-65027: Improper Neutralization of Input During Web Page Generation

RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the...

EUVD-2018-18049

Malware in sbrugna...

CVE-2025-57203

MagicProject AI version 9.1 is affected by a Cross-Site Scripting XSS vulnerability within the chatbot generation feature available to authenticated admin users. The vulnerability resides in the prompt parameter submitted to the /dashboard/user/generator/generate-stream endpoint via a...

Security Bulletin: IBM Storage Ceph is vulnerable to an incorrect authorization vulnerablity in Grafana.

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-31107. Vulnerability Details CVEID: CVE-2022-31107 DESCRIPTION: Grafana could allow a remote authenticated attacker to bypass security restrictions, caused by an OAuth vulnerabilit...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

Cross site request forgery (csrf)

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1...

CVE-2018-6288

Kaspersky Secure Mail Gateway 1.1.0.379 Web Management Console has multiple CSRF/CONFIG injection flaws described by CORE-2017-0010: CVE-2018-6288 enables admin takeover via missing anti-CSRF tokens; CVE-2018-6289 injects Postfix config to run commands as root; CVE-2018-6290 uses a setuid binary ...