EUVD-2026-51027

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

PT-2026-66420

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-48539

GFI Archiver prior to 15.13 is affected by CVE-2026-48539: a stored XSS in the MailInsights.aspx report naming parameter. An authenticated user can inject script/HTML that is stored by ReportScheduling.btnSaveReport_Click() and later executes in the viewer’s browser when they access the MailInsig...

CVE-2026-64812

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64812

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

EUVD-2026-48237

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64812

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64812

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64812

CVE-2026-64812 affects JetBrains IntelliJ IDEA prior to 2026.2. The vulnerability allows unauthorized input injection during a Remote Development session. Root cause details are not elaborated beyond the description; exploitation status and mitigation are not specified in the provided documents. ...

CVE-2026-64812: Missing Authentication for Critical Function

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

PT-2026-63966

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists where unauthorized input injection is possible during a Remote Development session. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

PT-2026-84875

Уязвимость сервиса input-remapper.service инструмента для управления устройствами ввода input-remapper связана с отсутствием авторизации. Эксплуатация уязвимости может позволить нарушителю переключить сервис на указанный конфигурационный каталог и запустить механизм инъекции ввода...

EUVD-2026-46006

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes protection is bypassed because it checks for getmagicquotesgpc, a function removed i...

CVE-2026-54163

secureheaders manages application of security headers with many safe defaults. Prior to 7.3.0, secureheaders builds the Content-Security-Policy value by stitching directives with ; separators, and buildsandboxlistdirective, buildmediatypelistdirective, and buildreporttodirective interpolate...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

CVE-2026-15067 Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration...

Cross-site Scripting in Ericsson CodeChecker

In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

AlmaLinux 9 : golang (ALSA-2026:29981)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:29981 advisory. net/textproto: golang: Golang net/textproto: Misleading error messages via input injection CVE-2026-42507 Bug Fixes and Enhancements: Update Go to version 1.26.4+...