119115 matches found
BIT-GHOST-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...
SUSE-SU-2026:24195-1 Security update for hawk2
This update for hawk2 fixes the following issues: - CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAPstarttls to return successfully, without starting TLS bsc1268996. - CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote co...
SUSE-SU-2026:24250-1 Security update for hawk2
This update for hawk2 fixes the following issues: - CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAPstarttls to return successfully, without starting TLS bsc1268996. - CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote co...
OPENSUSE-SU-2026:22068-1 Security update for hawk2
This update for hawk2 fixes the following issues: - CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAPstarttls to return successfully, without starting TLS bsc1268996. - CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote co...
CVE-2026-106155
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views t...
Sensitive Information Disclosure
Docling is vulnerable to sensitive information disclosure. The vulnerability is due to the HTML image resource loader forwarding configured headers to remote image URLs without restricting them to the source document’s origin, which allows an attacker to expose configured credentials, such as API...
[SECURITY] [DLA 4830-1] twitter-bootstrap3 security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4830-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès October 08, 2026 https://wiki.debian.org/LTS -...
authcov
AuthCov Escaneo de cobertura de autorización de aplicaciones web. Introducción AuthCov rastrea su aplicación web utilizando un navegador Chrome sin interfaz gráfica mientras está conectado como un usuario predefinido. Intercepta y registra las solicitudes API, así como las páginas cargadas durant...
CLEANSTART-2026-BP22763 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-ED67478 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...
CLEANSTART-2026-PV83976 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-TJ27898 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-27136 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-IQ69841 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-OL43911 html
Security vulnerability affects the ollama-fips package. The html...
CLEANSTART-2026-US20242 html
Security vulnerability affects the ollama-fips package. The html...
PT-2026-108954
Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description A stored mutation cross-site scripting issue exists where remote attackers can inject executable scripts. This occurs by placing payloads inside a element nested within MathML foreign conten...
PT-2026-108978
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...
PT-2026-109153
Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghost head helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...
CVE-2026-106155: Improper Neutralization of Input During Web Page Generation
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views t...
PT-2026-109129
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...