31234 matches found
CVE-2026-8920
creationtimestamp| type| source ---|---|--- 2026-07-15 04:19:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnukuc5ul22 2026-07-15 16:45:06+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:09:32+00:00| seen|...
MAL-2026-10653 Malicious code in webpack-session-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007695a788bff7d6d0a87ee48de6771c12a1e21241bd3fc0bc7b5509608533e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10646 Malicious code in @bcs-mi-ui/message-block (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58c86304011c297c4b10092f83a6dc1763b8174e91fd9e81f8487b959ecea539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Adobe Experience Manager 6.5.0 < 6.5.2 / 2026.5.0 < 2026.6.0 Multiple Vulnerabilities (APSB26-74)
The version of Adobe Experience Manager installed on the remote host is prior to 2026.6.0, 6.5.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-74 advisory. - Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Director...
PT-2026-60131
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.28.1 Description An information disclosure issue exists where external secrets are incorrectly resolved in workflow node expressions outside the credentials scope. Authenticated project editors can read plaintext extern...
PT-2026-60132
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions prior to 2.28.1 Description A permission bypass exists in external secrets handling due to a mismatch between the static validation check and the runtime expression engin...
CVE-2026-54684
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...
CVE-2026-48359
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially...
CVE-2026-45071
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent set DOMDocument::$validateOnParse = true before loadXML, re-enabling external entity resolution and allowing attacker-supplied XML ...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the caption-download process. An attacker can overwrite or create arbitrary files on the system by supplying a crafted file parameter to the MCP server, allowing modification of files outsid...
CVE-2026-48359
Adobe Experience Manager is affected by an XML External Entity (XXE) vulnerability (CVE-2026-48359) due to improper restriction of XML External Entity references. It could allow a low-privileged attacker to read sensitive files and potentially gain elevated access or control, with arbitrary code ...
CVE-2026-48359 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially...
CVE-2026-45071
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent set DOMDocument::$validateOnParse = true before loadXML, re-enabling external entity resolution and allowing attacker-supplied XML ...
CVE-2026-45071
CVE-2026-45071 affects the Symfony PHP framework (dom-crawler component). Before patches, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true prior to loadXML(), re-enabling external entity resolution and allowing attacker-controlled XML to resolve file:// URIs (local file disclosur...
CVE-2026-45071 Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent set DOMDocument::$validateOnParse = true before loadXML, re-enabling external entity resolution and allowing attacker-supplied XML ...
CVE-2026-50462
External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...
CVE-2026-54108
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-54108
CVE-2026-54108 affects Microsoft SharePoint Server. An authorized attacker can influence a file name or path in SharePoint, enabling network-based spoofing. CVSS v3.1: 6.5 (MEDIUM), AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Root cause details are not provided in the supplied documents; no exploitation...
