CVE-2026-18741

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

CVE-2026-17468

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

EUVD-2026-58471

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

CVE-2026-18741

Summary: CVE-2026-18741 affects Worksuite SaaS prior to v6.0.14 and is a stored cross-site scripting vulnerability in the Asset Management module. The flaw allows authenticated administrators to inject arbitrary JavaScript by submitting payloads into the Location or Description fields during asse...

CVE-2026-18741 Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

CVE-2026-18741 Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

CVE-2026-73656

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts,...

CVE-2026-49864

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log,...

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data

A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2025-62318

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

EUVD-2026-57924

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...

CVE-2026-19734

CVE-2026-19734 affects Roskus Prospero Flow CRM (before 5.4.7). The vulnerability arises from missing authorization checks in the product management flow, allowing authenticated users from any company to read full sensitive product data (price, cost, stock, SKU, barcode) and to hijack a product b...

EUVD-2025-210724

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2025-62318 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2025-62318

CVE-2025-62318 affects HCL AION. The issue involves JavaScript responses that contain data being referenced by external pages, enabling potential JavaScript hijacking where an attacker-controlled page could capture sensitive information under certain conditions. The vulnerability is described wit...

Dissecting the JWR phishing framework

Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven...

Johnson Controls Metasys

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and...