209753 matches found
CVE-2026-84357
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...
CVE-2026-84477
AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...
Directory Traversal
Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Directory Traversal in the toSSG static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that diffe...
Filebeat 8.19.18, 9.3.1 Security Update (ESA-2026-165)
Allocation of Resources Without Limits or Throttling CWE-770 in Filebeat can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the...
CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description
AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...
CVE-2026-84477
AVideo is vulnerable to a stored XSS in its live scheduling feature. The functions Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can subsequently access remindMe...
CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description
AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...
CVE-2026-84640
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...
CVE-2026-84642
Mozilla Thunderbird is affected by a vulnerability where the values of the mail.allowed_attachment_hostnames advanced configuration setting are used in a regular expression without proper escaping . This flaw could allow certain unintended hostnames to match the criteria, potentially enabling the...
CVE-2026-84640
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...
CVE-2026-73780
A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...
CVE-2026-73768
A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...
CVE-2026-73750
Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could...
CVE-2026-73751
An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...
CVE-2026-73749
Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code...
EUVD-2026-69643
A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...
CVE-2026-73780 Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX
A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...
CVE-2026-73768 Local Privilege Escalation in AOS-CX Command Line Interface
A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...
EUVD-2026-69632
A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...
CVE-2026-73768
CVE-2026-73768 is a local privilege escalation in the command line interface (CLI) of HPE ArubaOS-CX (AOS-CX) . The root cause is improper processing of malformed input , which can allow a low-privilege local user to execute arbitrary commands with root privileges . The CVSS 3.1 base score is 7.3...