60737 matches found
CVE-2026-73524
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
CVE-2026-73524
CVE-2026-73524 is a cross-site scripting (XSS) vulnerability in Cypht (versions before 2.12.2 ), located in the contacts module . The root cause is a flawed sanitization routine that removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact. An at...
CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
EUVD-2026-69652
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
PT-2026-84466
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
CVE-2026-73524: Improper Neutralization of Input During Web Page Generation
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
MSC-2026-11528
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-11519
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
PYSEC-2026-3781
opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...
EUVD-2026-67062
opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...
org.acegisecurity:acegi-security-samples-contacts (1.0.7), org.andromda.andromdapp.projects:andromda-andromdapp-project-richclient-ant (3.3) +1 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (1.2.9)
org.springframework:spring-webmvc MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.acegisecurity:acegi-security-samples-contacts 1.0.7 -...
MSC-2026-11478
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
CVE-2026-43679
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...
CVE-2026-43679
An authorization issue in FaceTime on watchOS (specifically for Apple Watch Series 6 and later) could allow an attacker with physical access to a locked device to view user contacts . The vulnerability was addressed by improving permissions checking . This security issue is fixed in watchOS 26.4 ...
CVE-2026-43679: Improper Access Control
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...
Malicious Package
Overview fb-forms-form-boilerplate-contacts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
CVE-2026-72585 Grafana - Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...