65655 matches found
CVE-2026-48356 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires...
CVE-2026-48000 Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Adobe Commerce is affected by an Improper Redirect Open Redirect vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim...
CVE-2026-48000
CVE-2026-48000 affects Adobe Commerce and is an open redirect vulnerability in the URL redirection logic. The underlying issue is an improper redirect that can bypass a security feature and potentially lead to credential theft or account takeover if a user clicks a malicious link. Exploitation re...
CVE-2026-48000 Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Adobe Commerce is affected by an Improper Redirect Open Redirect vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim...
GHSA-VVP9-H8P2-XWFC
creationtimestamp| type| source ---|---|--- 2026-07-14 19:42:05+00:00| seen| https://gist.github.com/alon710/553eb2089447345d30a93b1881dc2ee5...
CVE-2025-61670
creationtimestamp| type| source ---|---|--- 2026-07-14 19:42:05+00:00| seen| https://gist.github.com/alon710/553eb2089447345d30a93b1881dc2ee5...
CVE-2026-50526
Improper link resolution before file access 'link following' in .NET allows an authorized attacker to perform tampering locally...
CVE-2026-48038
Joi (JavaScript) vulnerability CVE-2026-48038: In versions prior to 17.13.4 and 18.2.1, validation of deeply nested user input via recursive link() schemas can trigger an unhandled RangeError when validate() runs without try/catch, potentially crashing the process. Fixed in 17.13.4 and 18.2.1. CV...
CVE-2026-48038 joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link schemas. When validate is called without try/catch in a reque...
GHSA-G7MM-9VX7-JM7H
creationtimestamp| type| source ---|---|--- 2026-07-14 19:11:47+00:00| seen| https://gist.github.com/alon710/97fd87eaf3ecb37ec75f6abd3050d94a...
CVE-2026-50141
creationtimestamp| type| source ---|---|--- 2026-07-14 19:11:47+00:00| seen| https://gist.github.com/alon710/97fd87eaf3ecb37ec75f6abd3050d94a...
CVE-2026-50684
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:32+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:02:29+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:13+00:00| seen|...
CVE-2026-44800
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:08+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:29+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:02+00:00| seen|...
CVE-2026-56170
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:00+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0235 2026-07-14 20:34:13+00:00| seen| https://bsky.app/profile/blowdart.me/post/3mqn2jvvr2k2u 2026-07-14 20:34:27+00:00| seen|...
CVE-2026-45064
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...
CVE-2026-45064 Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...
CVE-2026-45753
Symfony HtmlSanitizer UrlAttributeSanitizer omits action, formaction, poster, and cite URL-valued attributes, allowing javascript: URIs to bypass sanitization and enable XSS when forms or buttons are used. Affected: Symfony components prior to versions 6.4.40, 7.4.12, and 8.0.12. Mitigation: upgr...
CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...
