68081 matches found
CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...
CVE-2026-65485
Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...
PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
SummaryA workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check...
PYSEC-2026-3526 PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Summary A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role chec...
EUVD-2026-48096
Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...
CVE-2026-65485
Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...
CVE-2026-65485
CVE-2026-65485 affects the WordPress plugin Content Control
CVE-2026-65485 WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...
CVE-2026-57808
The CVE-2026-57808 entry concerns the WordPress WP EasyPay plugin (
EUVD-2026-48183
Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...
CVE-2026-57808 WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...
CVE-2026-57808 WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the Network of Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy through a crafted Chrome extension. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in isolated web apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the Network component of Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass content security policies through malicious network traffic. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the Parser component of Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policies through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-65755
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially...