Thymeleaf Expression Language XSS

The vulnerability of the JavaScript-based Thymeleaf engine is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a remote attacker to bypass existing security mechanisms...

JavaScript Serialization Uncontrolled Resource Consumption DoS

The vulnerability of the library for serializing JavaScript objects into a string format is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

GitLab 14.0 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-3093)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker t...

Alt-N MDaemon 20.0.x < 20.0.9 / 21.0.x < 21.0.8 / 21.5.x < 21.5.6 / 22.0.x < 22.0.7 / 23.0.x < 23.0.4 / 23.5.x < 23.5.5 / 24.0.x < 24.0.4 / 24.5.x < 24.5.3 / 25.0.x < 25.0.3 Stored XSS

The remote Windows host is running a version of MDaemon Email Server that is affected by a stored cross-site scripting XSS vulnerability. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript cod...

CVE-2026-46594: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

CVE-2026-52232

A reflected cross-site scripting XSS vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

PT-2026-66699

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfiltered html capability to store JavaScript that runs...

📄 DbGate 7.1.8 Remote Code Execution

A proof of concept exploit for a DbGate 7.1.8 unauthenticated remote code execution vulnerability. The exploit abuses the /runners/start endpoint by injecting JavaScript through the JSON script runner's functionName field, allowing arbitrary operating system commands to be executed and their outp...

CVE-2026-59232: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...

CVE-2026-17658

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523030583...

CVE-2026-17807

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516763884...

CVE-2026-17952

An inappropriate implementation flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517316174...

CVE-2026-17920

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513413942...

CVE-2026-17836

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517972812...

Malicious code in 1apijs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2700f92a449d39fb0881259de81734a6c2f7933dad7e567fd4284e58b6fe062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

leanplum-sdk (1.13.0) potentially affected by CVE-2025-51684 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2025-51684 Source advisory: SNYK:JS-CLEVERTAPWEBSDK-18508175...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

UBUNTU-CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

EUVD-2025-13500

AWS Amplify Studio UI Component Properties Has an Input Validation Issue...

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities components, forms, views, and themes primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface AWS CLI for generating component files in...