19062 matches found
CVE-2026-9144: Improper Neutralization of Input During Web Page Generation
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields...
CVE-2026-9139: Use of Hard-coded Credentials
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source...
GHSA-58QX-3VCG-4XPX
creationtimestamp| type| source ---|---|--- 2026-05-19 19:42:10+00:00| seen| https://gist.github.com/konard/d8a22725a8b00a188eb2098b18eaa766 2026-05-19 19:44:33+00:00| seen| https://gist.github.com/konard/beb604d0f86e740a59c10cc19fb9b50b 2026-05-19 20:19:30+00:00| seen|...
MAL-2026-4171 Malicious code in @mc-xp/mc-monolith-js-src-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2006e65ebcb876e87abed337730b23f079632086ac5af42f731dd65e20dbc56f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-42096
creationtimestamp| type| source ---|---|--- 2026-05-19 02:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-42096 2026-05-19 19:00:05+00:00| seen| https://t.me/GithubRedTeam/84866 2026-05-19 21:00:04+00:00| published-proof-of-concept|...
CLSA-2026-1779153000 golang: Fix of CVE-2026-32283
CVE-2026-32283: fix TLS 1.3 deadlock in crypto/tls handleKeyUpdate when a peer sends multiple key update messages requesting a response in a single record by adding a locked flag to setReadTrafficSecret so it calls sendAlertLocked instead of re-locking the connection mutex...
MAL-2026-3999 Malicious code in @antv/geo-coord (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
CVE-2026-3471
Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...
EUVD-2026-30757
Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...
CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App
Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...
CVE-2026-8782
creationtimestamp| type| source ---|---|--- 2026-05-18 06:08:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm47kzzxps2c...
CVE-2018-25328
creationtimestamp| type| source ---|---|--- 2026-05-17 14:56:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2mmwodr52k...
CVE-2026-8657
creationtimestamp| type| source ---|---|--- 2026-05-17 01:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlz7m3b64q22 2026-05-17 01:30:47+00:00| seen| https://infosec.exchange/users/offseq/statuses/116587326764358912 2026-07-06 06:49:16+00:00| seen|...
CVE-2026-41427
creationtimestamp| type| source ---|---|--- 2026-05-16 16:32:11+00:00| seen| https://gist.github.com/yanchuk/859e9c10826efe814725781953466c18...
CVE-2026-42207
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, MageProductAlertAddController::stockAction reads the uenc query parameter and passes...
CVE-2026-3160
creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260515...
CVE-2025-38708
creationtimestamp| type| source ---|---|--- 2026-05-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10...
CVE-2019-13103
creationtimestamp| type| source ---|---|--- 2026-05-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16...
CVE-2026-46391
creationtimestamp| type| source ---|---|--- 2026-05-14 09:00:04+00:00| seen| Telegram/Ab4OFqOZ0GdnyIUaC77uZ2CbzoeHzhCrZHfEopJ-gCMQVg 2026-05-19 14:44:46+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-4fg7-f244-3j49 2026-07-13 22:00:22+00:00| seen|...