34422 matches found
CVE-2026-66353 Doggo vulnerable to cross-site scripting via unescaped date field values
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim", without...
CVE-2026-66353
woylie doggo (an Elixir/Phoenix ecosystem library) contains a Reflected XSS in Doggo.normalize_value/2 (lib/doggo.ex), which returned date field values wrapped in the {:safe, ...} Phoenix.HTML marker without escaping them, causing unescaped user input to reach the value attribute of during form ...
Malicious Package
Overview tailwindcss-form-styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
WordPress MC4WP: Mailchimp for WordPress plugin <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages vulnerability
Authenticated Author+ Stored Cross-Site Scripting via Form Response Messages vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin MC4WP versions = 4.12.0...
CVE-2026-78292
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
curl: 55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form data
Summary curlformaddccsid in projects/OS400/ccsidcurl.c performs a heap-buffer-overflow read when CURLFORMCONTENTTYPE appears before an explicit length CURLFORMCONTENTLEN / CURLFORMCONTENTSLENGTH for binary CURLFORMCOPYCONTENTS data containing embedded NUL bytes. The overread bytes are copied into...
CVE-2026-81276 WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...
CVE-2026-81276
CVE-2026-81276 affects the Kali Forms WordPress plugin in versions 2.4.23 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 5.3 (Medium) with an attack vector of network, low complexity, no required privileges, and a low impact on integrity. The issue wa...
CVE-2026-78292
CVE-2026-78292 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Hash Form , affecting versions
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
EUVD-2026-66946
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-77035
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...
CVE-2026-77035
Joomla Event Manager (joomlaeventmanager.net) versions prior to 5.0.1 are affected by a cross-user event and venue takeover vulnerability. A registered user with edit-own rights (via the eventowner=1 setting or core.edit.own permission) can forge form fields by POSTing another user's record ID to...
CVE-2026-77035 Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...
EUVD-2026-66863
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...
CVE-2026-77035 Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...
CVE-2026-77035
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...
SUSE CVE-2026-68525
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...
