54 matches found
DEBIAN-CVE-2026-90197
In the Linux kernel, the following vulnerability has been resolved: HID: haptic: don't write an uninitialized value to unhandled usages filleffectbuf initializes value only for the four haptic usages handled by its switch, but writes it to field-value for every usage. An unhandled usage can...
CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
Exploit for CVE-2026-79387
CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Manageme...
CVE-2026-82739 Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implementation atomic/2 in lib/ash/resource/validation/confirm.ex...
BIT-KIBANA-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data
The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...
CVE-2026-71245
CVE-2026-71245 is explicitly rejected; Red Hat CNA-LR concluded it is not valid, so it does not represent an active vulnerability entry and no risk assessment applies.
CVE-2026-71245
...
PT-2026-60793
Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the before action ensure admin...
CVE-2025-61550
Cross-Site Scripting XSS is present on the ctl00Content01fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 fixed in 19.69. User-supplied input is stored and later rendered in HTML pages without prope...
CVE-2025-61550
Cross-Site Scripting XSS is present on the ctl00Content01fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 fixed in 19.69. User-supplied input is stored and later rendered in HTML pages without prope...
The vulnerability of the verify_field_val() function in the Integration for Contact Forms and Google Sheets plugin of the WordPress content management system allows a hacker to execute arbitrary code or cause a service failure.
The vulnerability of the verifyfieldval function in the Integration for Contact Forms and Google Sheets plugin of the WordPress content management system is related to deserialization mechanism flaws. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause...
CVE-2025-11980
The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'deleteorphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
Wimi Teamwork 安全漏洞
Wimi Teamwork is a team collaboration cloud platform from Wimi USA. A security vulnerability exists in Wimi Teamwork versions prior to 7.38.17 that stems from the API not validating the csrftoken field value, which could lead to a cross-site request forgery attack...
EUVD-2025-25649
Malicious code in bioql PyPI...
CVE-2025-9391
A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made...
CVE-2025-9391
A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made...
PT-2025-16116 · WordPress · Everest Forms
Name of the Vulnerable Software and Affected Versions: Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress versions up to, and including, 3.1.1 Description: The vulnerability allows unauthenticated attackers to inject a PHP Object via deserialization of...
GHSA-3QX8-RV27-J6GP Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device`
An issue was identified in the VmFd::createdevice function, leading to undefined behavior and miscompilations on rustc 1.82.0 and newer due to the function's violation of Rust's pointer safety rules. The function downcasted a mutable reference to its struct kvmcreatedevice argument to an immutabl...
WordPress AutomatorWP plugin <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value vulnerability
Reflected Cross-Site Scripting via a-0-o-searchfieldvalue vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin AutomatorWP versions = 5.0.9...