CVE-2026-76252: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user...

CVE-2026-74869 stoatchat before 0.15.0 Missing Authorization via Subscribe

stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sendin...

CVE-2026-19995

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-19995

Webkul Bagisto (up to 2.4.4) is affected in the RMA Message Handler, specifically the /customer/account/rma/send-message path. The vulnerability stems from manipulating the Message argument, leading to cross-site scripting. Remote exploitation is possible, and exploits have been publicly disclose...

EUVD-2026-60061

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-19995 Webkul Bagisto RMA Message send-message cross site scripting

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-19995

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

PT-2026-76605

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.0 Description A missing authorization issue exists in the Subscribe message handler. Authenticated attackers can enumerate members and monitor profile updates of private servers they are not members of. By...

CVE-2026-19995: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-74869: Missing Authorization

stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sendin...

CVE-2026-69114 Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

The vulnerability of the Message Handler component in the FreeBSD operating system allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the Message Handler component in FreeBSD operating systems is related to the lack of proper checking of the length of user data before it is copied to the buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

CVE-2026-19363

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

CVE-2026-19363

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

CVE-2026-19363

CVE-2026-19363 affects the lmammino oidc-authorizer package up to version 0.4.0. The flaw resides in the unwrap function of src/handler.rs in the Fixed Message Handler, where manipulating the jwtClaims argument enables deserialization and remote execution. Public exploitation is noted, and the ve...

EUVD-2026-54934

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is the function unwrap of the file src/handler.rs of the component Fixed Message Handler. The manipulation of the argument jwtClaims results in deserialization. The attack can be executed remotely. The exploit has been ma...

CVE-2026-19363 lmammino oidc-authorizer Lambda Authorizer handler.rs log file

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

SUSE CVE-2026-8780

A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is publicly availabl...

SUSE CVE-2026-9301

A vulnerability was found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGReset Message Handler. Performing a manipulation results in memory corruption. The attack is possible to be carried out remotely. The exploit has been made public and could be use...

The vulnerability of the _ipmidestroy_user() function in the drivers/char/ipmi/ipmi_msghandler.c driver for Linux alphabetized numerical devices allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ipmidestroyuser function in the drivers/char/ipmi/ipmimsghandler.c driver for Linux alphabetically numbered devices in the operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...