EUVD-2026-90436

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2025-12030

CVE-2025-12030: Referencia Directa Insegura a Objetos en el Plugin ACF to REST API de WordPress Palabras clave: CVE-2025-12030, vulnerabilidad de ACF to REST API, IDOR, seguridad de WordPress, explotación autenticada, vulnerabilidad de plugin de WordPress, CWE-639, modificación de campos ACF,...

Rocky Linux 9 [CIQ] Security Update: libndp / libndp-debuginfo / libndp-debugsource (crlsa-2024_4636)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244636 advisory. libndp: buffer overflow in route information length field CVE-2024-5564 Tenable has extracted the preceding description block directly from the CIQ security advisor...

grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation

A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting XSS vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style's attribution field into the page without proper sanitization. By...

CVE-2026-103588

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-102998

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/appearancestream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled,...

CVE-2026-102998 pypdf: Possible long runtimes when generating appearance streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/appearancestream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled,...

CVE-2026-102998

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/appearancestream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled,...

CVE-2026-102998 pypdf: Possible long runtimes when generating appearance streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/appearancestream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled,...

CVE-2026-62308

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2023-28467

MyBB 1.8.33 XSS persistente en email del Panel de Control de Usuario - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com Solución Actualiza MyBB a la versión 1.8.34 o superior...

CVE-2022-24124

Prefacio Casdoor es una plataforma de autenticación de inicio de sesión único SSO centralizada basada en OAuth 2.0/OIDC ID ID de CVE: CVE-2022-24124 ID CNPD: CNPD-202201-7304 Versiones afectadas Nivel de riesgo: Alto 7.5 HIGH POC/EXP: Público Casdoor POC:...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-103397

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged...

EUVD-2026-89992

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged...

CVE-2026-103389

MISP versions prior to 2.5.48 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The root cause is the lack of server-side validation on the icon field of a galaxy object during add, edit, and sync/import capture operations. The D3-based correlat...

CVE-2026-103388

Versions of MISP prior to 2.5.48 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the Galaxy Cluster source field . The vulnerability occurs because the application renders the source field as a clickable hyperlink if it passes PHP's FILTER_VALIDATE_URL validation, which incorrectly ...