Asseco InfoMedica 安全漏洞

Asseco InfoMedica is a comprehensive healthcare information management system from Asseco Poland. A security vulnerability exists in Asseco InfoMedica version 4.50.1 and prior to version 5.38.0, which stems from a client-side algorithm that can decode stored passwords, potentially leading to...

edu Business Solutions Print Shop Pro WebDesk 安全漏洞

edu Business Solutions Print Shop Pro WebDesk is a print order management system from US-based edu Business Solutions. A security vulnerability exists in edu Business Solutions Print Shop Pro WebDesk version 18.34, which stems from insufficient validation of client-side inputs and could lead to a...

@adobe-commerce/elsie (2.1.0-beta.7), @aigelb/chatbot-widget (>=5.0.0, <=8.2.0) +15 more potentially affected by CVE-2026-22028 via preact (>=10.27.0, <=10.27.2)

preact NPM version =10.27.0, =5.0.0, =0.0.1, =0.2.0-canary.7cb2837, =1.2.1, =1.4.1-snapshot-20251113025641, =3.0.263, =0.1.17, =0.1.17, =0.2.22, =1.14.0, =0.0.111, =0.0.122 and more Source cves: CVE-2026-22028 Source advisory: SNYK:JS-PREACT-14897824...

@clidey/dory (0.35.0), @garage44/bunchy (>=2.0.0, <=2.1.12) +15 more potentially affected by CVE-2026-22028 via preact (>=10.26.5, <=10.26.9)

preact NPM version =10.26.5, =2.0.0, =1.0.5, =3.0.0, =2.0.0, =19.0.0, =19.0.0, =19.0.0, =1.1.6, =5.14.0, =0.0.105, =0.0.105, =0.0.2, =0.0.109, =0.0.110 and more Source cves: CVE-2026-22028 Source advisory: OSV:GHSA-36HM-QXXP-PG3M...

@clidey/dory (0.35.0), @garage44/bunchy (>=2.0.0, <=2.1.12) +15 more potentially affected by CVE-2026-22028 via preact (>=10.26.5, <=10.26.9)

preact NPM version =10.26.5, =2.0.0, =1.0.5, =3.0.0, =2.0.0, =19.0.0, =19.0.0, =19.0.0, =1.1.6, =5.14.0, =0.0.105, =0.0.105, =0.0.2, =0.0.109, =0.0.110 and more Source cves: CVE-2026-22028 Source advisory: SNYK:JS-PREACT-14897824...

@adobe-commerce/elsie (2.1.0-beta.7), @aigelb/chatbot-widget (>=5.0.0, <=8.2.0) +15 more potentially affected by CVE-2026-22028 via preact (>=10.27.0, <=10.27.2)

preact NPM version =10.27.0, =5.0.0, =0.0.1, =0.2.0-canary.7cb2837, =1.2.1, =1.4.1-snapshot-20251113025641, =3.0.263, =0.1.17, =0.1.17, =0.2.22, =1.14.0, =0.0.111, =0.0.122 and more Source cves: CVE-2026-22028 Source advisory: OSV:GHSA-36HM-QXXP-PG3M...

@knowbl_ai/nexus-chat (1.0.0), @wistia/wistia-player (0.4.0) +2 more potentially affected by CVE-2026-22028 via preact (>=10.28.0, <=10.28.1)

preact NPM version =10.28.0, =10.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on preact and may be impacted: - @knowblai/nexus-chat 1.0.0 - @wistia/wistia-player 0.4.0 - @wistia/wistia-player-react 0.4.0 - astro-og 0.3.1 Source cves: CVE-2026-2202...

CVE-2019-12421

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out t...

PT-2026-1687

A critical Arbitrary File Read vulnerability CVE-2023-50024 has been discovered in the jsPDF library, a popular JavaScript library for client-side PDF generation. Adobe CyberSecNews CyberSecurityAwareness DataSecurity Spyware...

CVE-2020-36923 Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR

Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '//content-creation' by manipulating client-side access restrictions...

PT-2026-1456

Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '//content-creation' by manipulating client-side access restrictions...

Apache Kyuubi 安全漏洞

Apache Kyuubi is a distributed SQL gateway from the Apache Foundation. Apache Kyuubi suffers from a directory traversal vulnerability that originates from a client-side bypass of server-side configuration, which can be exploited by an attacker to cause access to unauthorized local files...

CVE-2025-64119 Nuvation Energy BMS Client-side Authentication

A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9...

CVE-2025-64119

CVE-2025-64119 : A vulnerability in the Nuvation Battery Management System allows authentication bypass, affecting BMS versions up to 2.3.9. The entry is supported by other sources (Red Hat/EUVD) with the same description. The CVSSv4 metrics indicate critical impact (base score 9.3) across confid...

CVE-2025-64119: Use of Client-Side Authentication

A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9...

Windows DNS Client: undisclosed vulnerability (ZAI-2026-GX4T5X)

Not disclosed. Details are not yet publicly disclosed...

CVE-2025-62750 WordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Filipe Seabra WooCommerce Parcelas woocommerce-parcelas allows DOM-Based XSS.This issue affects WooCommerce Parcelas: from n/a through = 1.3.5...

ASLR-bypass-simulation

ASLR Bypass Simulator An interactive educational web applicat...

The vulnerability of KYC Solutions’ software for customer identity verification lies in the implementation of security features on the client side, which allow attackers to circumvent existing security restrictions.

The vulnerability of KYC Solutions’ software for customer identity verification is related to the implementation of security features at the client side. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...

CVE-2025-66103

CVE-2025-66103 corresponds to a vulnerability in WPCal.io (as reported by Wordfence) affecting version up to 0.9.5.9, described as an Authenticated (Contributor+) Stored Cross-Site Scripting via the events_list_grouped shortcode and patched. The initial description also mentions a DOM-based XSS i...