PT-2026-81048

Name of the Vulnerable Software and Affected Versions Boost versions prior to 2.0.5 Description An unauthenticated Cross-Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the context of a user's session without requiring prior authentication. Recommendation...

dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset

A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...

dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset

A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...

CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...

PT-2026-79088

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

CVE-2026-59992

creationtimestamp| type| source ---|---|--- 2026-08-19 22:35:05+00:00| published-proof-of-concept| https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4...

UBUNTU-CVE-2026-63652

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

ANT-2026-AM0R21ZY · supabase/supabase · broken-access-control

broken-access-control medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-AM0R21ZY: HIPAA sensitive-project AI block enforced only client-side The client hook...

BIT-JAVA-MIN-2026-60164

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

PT-2026-73214

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

PT-2026-73330

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

CVE-2026-73295

A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting XSS vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution...

JLSEC-2026-1326 ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a...

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side...

EUVD-2026-58245

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log,...

CVE-2026-73647

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:03+00:00| published-proof-of-concept| https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j...

CVE-2026-59504

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59504 Priority – CWE-602: Client-Side Enforcement of Server-Side Security

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59504

Technical details about CVE-2026-59504 are not provided in the supplied documents. Monitor for updates as public details remain unavailable.

CVE-2026-59504 Priority – CWE-602: Client-Side Enforcement of Server-Side Security

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...