Vtiger CRM v7.2.0 - Directory Listing

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...

CVE-2021-44228

Log4j Vulnerabilities Update 19.12.2021: New vulnerabilities and new ways to exploit them in Log4j are constantly being discovered. We have added three flowcharts mind maps to the git repo that respectively describe vulnerable versions of Log4j, how to check if you are vulnerable, and mitigation ...

BIT-JOOMLA-2026-90914 Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm raid: fixed access issues beyond the end of the raid member array. When the dm-raid table is loaded using raidctr, dm-raid allocates an array rs-devsrs-raiddisks for the raid device members. rs-raiddisks is determined by the...

CVE-2026-90914

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

CVE-2026-90914

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

CVE-2026-90914 Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

CVE-2026-90914 Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

EUVD-2026-89083

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

CVE-2026-90914

A cross-site scripting (XSS) vulnerability exists in Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . The root cause is a lack of escaping within the generic audio and video output layouts . This flaw allows an attacker to execute malicious scripts in the context of a user's session. No specif...

CVE-2026-90914: Improper Neutralization of Input During Web Page Generation

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

PT-2026-102690

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Lack of escaping in the generic audio and video output layouts leads to a Cross-Site Scripting XSS issue. XSS is a flaw that allows an attacker to...

CVE-2026-89686

A flaw was found in the Linux kernel's Network File System Daemon nfsd for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service DoS. This occurs when the nfsd4alloclayoutstateid function accesses a file pointer without proper locking...

CVE-2026-86730

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

Linux Distros Unpatched Vulnerability : CVE-2026-85485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3...

CVE-2026-85611

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

EUVD-2026-71034

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

EUVD-2026-71030

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...