EUVD-2026-97965

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-109322

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

CVE-2026-109322 Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

CVE-2026-109322

The Grav Guestbook plugin before version 0.5.2 is vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the AJAX Load more and Admin Load all handlers, which insert stored author and message fields into the DOM as unescaped HTML using jQuery . This allows unauthenticated vi...

EUVD-2026-97624

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

CVE-2026-109322 Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

CVE-2026-109322 Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

CVE-2026-109322

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

phpmyadmin-importldi

abraxaslabs.tech · github.com/abraxas ·&...

PT-2026-110962

Name of the Vulnerable Software and Affected Versions GNU Aspell versions prior to 0.60.8.3 Description A heap-based buffer overflow write exists in the read-only dictionary loader. The String::reserve function in common/string.hpp performs a capacity check using a signed integer ints + 1, which...

PT-2026-110595

SGLang through 0.5.21 contains a decompression amplification vulnerability in load audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio url or audio...

PT-2026-110960

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware versions FW1060.00 through FW1060.81 Description An issue exists in the host firmware configuration parsing. An attacker with authenticated service-level access to the Flexible Service Processor FSP can write special...

PT-2026-110739

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

CVE-2026-109322: Improper Neutralization of Input During Web Page Generation

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

cracklord

Cracklord http://jmmcatee.github.io/cracklord/ ¿Qué Es? CrackLord es un sistema diseñado para proporcionar un sistema escalable, conectable y distribuido tanto para el descifrado de contraseñas como para cualquier otro trabajo que necesite muchos recursos informáticos. Dicho de otra manera,...

CVE-2026-108754

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...

CVE-2026-108754 GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...

CVE-2026-108754

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...

CVE-2026-108754

Versions of GPT-Load through 1.4.11 are vulnerable to a cleartext logging flaw where the Gin Logger middleware records raw query strings. This occurs because the logging happens before the extractAuthKey function can strip the sensitive key parameter. An attacker with read access to console logs ...

EUVD-2026-96919

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...