66102 matches found
Cross-Site Scripting (XSS)
github.com/argoproj/argo-cd is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper URL validation in link.argocd.argoproj.io/ annotations, which allows an attacker with developer-level access to inject a javascript: URI using the pipe-separator trick and execute arbitrary...
CVE-2026-40411
creationtimestamp| type| source ---|---|--- 2026-05-23 03:59:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmikpvbh6e2p 2026-05-27 19:37:05+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmuaycjlbz2y...
CVE-2026-42834
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-41091
Improper link resolution before file access 'link following' in Microsoft Defender allows an authorized attacker to elevate privileges locally...
[SECURITY] Fedora 44 Update: composer-2.9.8-1.fc44
Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...
CVE-2026-40166
creationtimestamp| type| source ---|---|--- 2026-05-22 22:42:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhyz7op7v2e...
CVE-2026-39970
creationtimestamp| type| source ---|---|--- 2026-05-22 22:32:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhygjnno62o 2026-05-23 20:27:45+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116625766625880175 2026-06-06 11:02:43+00:00| seen|...
CVE-2026-39966
creationtimestamp| type| source ---|---|--- 2026-05-22 22:12:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhxe3r7ma2c...
CVE-2026-3294
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full...
CVE-2026-3294 Authentication Logic Vulnerability on Multiple TP-Link Range Extenders
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full...
CVE-2026-3294
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full...
CVE-2026-3294 Authentication Logic Vulnerability on Multiple TP-Link Range Extenders
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full...
CVE-2026-3294
CVE-2026-3294 concerns an authentication logic vulnerability in multiple TP-Link range extenders. The issue allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation, enabling full administrative c...
EUVD-2026-31502
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full...
CVE-2026-39966
TypeBot is a chatbot builder tool. In versions 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user who references a target bot ID in a Typebot Link block, regardless of workspace ownership, leading to IDOR. The authorization check uses Array.filter wi...
CVE-2026-39964
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...
CVE-2026-39970
The CVE covers TypeBot (chatbot builder) ≤ version 3.15.2, where the profile picture upload form fails to sanitize SVG/XML uploads and directly renders them. This enables stored XSS via crafted SVGs containing JavaScript, with payload stored on app.typebot.io and accessible via a permanent link, ...
CVE-2026-39964
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...