58410 matches found
EUVD-2026-31176
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...
CVE-2026-35008
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...
CVE-2026-35008
CVE-2026-35008 affects Open ISES Tickets prior to version 3.44.2. The vulnerability is a reflected XSS in single.php where an unsanitized ticket_id GET parameter is echoed into an HTML attribute, enabling an authenticated attacker to inject arbitrary JavaScript via a crafted URL. Impact is descri...
CVE-2026-35008 Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...
CVE-2026-35007
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in singleunit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a maliciou...
CVE-2026-35007 Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in singleunit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a maliciou...
EUVD-2026-31175
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in singleunit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a maliciou...
CVE-2026-35007
Open ISES Tickets
CVE-2026-20171
creationtimestamp| type| source ---|---|--- 2026-05-20 18:47:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmckxnd7wn2h 2026-07-23 12:18:09+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrcszvdsr52x...
CVE-2026-9136 Unauthorized ShadowAttribute modification in MISP via client-supplied identifier
A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update...
CVE-2026-9136 Unauthorized ShadowAttribute modification in MISP via client-supplied identifier
A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update...
CVE-2026-9136 Unauthorized ShadowAttribute modification in MISP via client-supplied identifier
A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update...
CGA-3893-P8H8-XVP4
Bulletin has no description...
CVE-2026-9084
MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid...
MINI-72GJ-V9HR-W5R8
Bulletin has no description...
CVE-2026-9087 Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login
A flaw was found in Keycloak. The cross-session verification proof is keyed only by local userId, idpAlias and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account...
MINI-MC73-9H6W-VF8J
Bulletin has no description...
CVE-2026-35676
creationtimestamp| type| source ---|---|--- 2026-05-20 15:45:53+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-9qv9-8xv6-5p35 2026-05-28 17:34:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwklaw3se2c...