209711 matches found
PT-2026-85137
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...
CVE-2026-85239: Improper Input Validation
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...
PT-2026-85022
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...
CVE-2026-85170: Improper Input Validation
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...
Linux BPF Heap Buffer Overflow DoS
The vulnerability of the btffuncprotocheck function in the kernel/bpf/btf.c module, which is part of the Linux kernel’s BPF support, relates to incorrect checking of the specified data type for input parameters. Exploiting this vulnerability could allow an attacker to trigger a service failure...
UBUNTU-CVE-2026-65138
Fix heap over-read when unpacking a malformed forward data RPC in slurmd. Fix a slurmd crash when handling a malformed forward data RPC with a missing socket address...
PT-2026-85236
Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 152.0.7977.82 Description Improper input validation in the Transactions Platform allows a remote attacker to potentially execute arbitrary code outside the sandbox when a user visits a crafted HTML page...
CVE-2026-78583: Incorrect Authorization
Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...
PT-2026-85124
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...
Linux Distros Unpatched Vulnerability : CVE-2026-70405
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message...
PT-2026-84952
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A copy-paste error during F55 sensor detection causes the transmitter TX electrode count to be incorrectly assigned the value of the receiver RX electrode count. This incorrect value is...
Linux Distros Unpatched Vulnerability : CVE-2026-70409
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by...
CVE-2026-85047: Improper Input Validation
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
Linux kernel VFSOCK Buffer Overflow
The vulnerability of the vsockupdatebuffersize function in the net/vmwvsock/afvsock.c module, which is part of the Linux kernel’s networking functions, is related to the incorrect order of operation of the input data validation mechanism. Exploiting this vulnerability could allow an attacker to...
IBM RSA kernel Command File Write Disclosure
The vulnerability of the commandfilewrite function in the drivers/misc/ibmasm/ibmasmfs.c module of the IBM RSA kernel of the Linux operating system’s service processor is related to incorrect input of configuration data. Exploiting this vulnerability can allow an attacker to disclose protected...
AlmaLinux 8 : grafana (ALSA-2026:62407)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62407 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...
ALSA-2026:63022 Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...
GHSA-P8RW-8QJ3-HF33 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...
K000163187: Intel UEFI vulnerability CVE-2025-20064
Security Advisory Description Improper input validation in the UEFI FlashUcAcmSmm module for some IntelR reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result m...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...