57654 matches found
EUVD-2026-48293
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...
CVE-2026-48530
CVE-2026-48530 affects GFI Archiver prior to 15.13, with a stored XSS in Classification Rules via CategorizationPolicyWizard.aspx. An authenticated attacker can inject script or HTML through rule name and email criteria parameters; the payload is stored by SaveAllConfigSettings() and executed in ...
JLSEC-2026-778
A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH Secure Shell connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an...
CVE-2026-65899 DOMPurify before 3.4.9 Trusted Types Policy State Contamination
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...
CVE-2026-64811
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration...
CVE-2026-64807
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration...
CVE-2026-64800
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...
CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...
PYSEC-2026-3473 LangBot: Authenticated RCE Via MCP Configuration
Summary Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command. Details The repository uses StdioServerParameters which is based on Anthropic's modelcontextprotocol open...
PYSEC-2026-3518 PraisonAI Slack app_mention bypasses configured user/channel authorization
PraisonAI Slack appmention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack...
PYSEC-2026-3528 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint
Summary The SSE Server-Sent Events server in src/praisonai-agents/praisonaiagents/server/server.py exposes a /publish endpoint that broadcasts arbitrary messages to all connected clients without any authentication. The ServerConfig dataclass line 24 defines an authtoken field, but this token is...
PYSEC-2026-3458 ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...
CVE-2026-64811
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration...
EUVD-2026-48232
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration...
CVE-2026-64807
CVE-2026-64807 affects JetBrains WebStorm prior to 2026.2. The issue enables arbitrary code execution via a project-supplied linter configuration. According to CVSS 3.1, the vulnerability has a base score of 7.8 (HIGH), with LOCAL attack vector, LOW attack complexity, no privileges required, and ...
CVE-2026-64807
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration...
EUVD-2026-48226
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...
CVE-2026-64800
CVE-2026-64800 : In JetBrains GoLand before 2026.2, sensitive configuration values are written to log files by default, exposing potentially sensitive data. The connected sources confirm the affected product/version and the root cause (logging of sensitive values). No exploitation, mitigation ste...
