Linux Distros Unpatched Vulnerability : CVE-2026-59280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...

CVE-2026-82554

A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/addcustomer.php. This manipulation of the argument Name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used...

CVE-2026-82554

SourceCodester Queue Management System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the file /api/add_customer.php . Manipulating the Name parameter allows a remote, unauthenticated attacker to inject script, requiring user interaction to trigger. The impact is rated MEDIUM (C...

CVE-2026-82554 SourceCodester Queue Management System add_customer.php cross site scripting

A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/addcustomer.php. This manipulation of the argument Name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used...

CVE-2026-82654

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82656

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82656 Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82654 SiYuan before v3.8.1 Stored XSS via block name

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

EUVD-2026-68240

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82654 SiYuan before v3.8.1 Stored XSS via block name

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82654

SiYuan before v3.8.1 is affected by a Stored XSS caused by improper escaping of block name , alias , and memo fields in hint, backlink, and breadcrumb rendering functions. An attacker can set a block's name to contain HTML or script tags that execute when another user views a document referencing...

CVE-2023-41255

creationtimestamp| type| source ---|---|--- 2026-08-30 09:00:05+00:00| seen| Telegram/UGgGAoNEue2MyCujvvwdDQWtDO2xEIWXCSv0LD0eAe5covZ4 2026-08-31 00:00:27+00:00| seen| Telegram/UGgGAoNEue2MyCujvvwdDQWtDO2xEIWXCSv0LD0eAe5covZ4...

PT-2026-83580

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1 Description Improper escaping of block name, alias, and memo fields occurs within the hint, backlink, and breadcrumb rendering functions. This allows an attacker to inject HTML or script tags into a block's name,...

EUVD-2026-67941

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message,...

FreeBSD : NSD -- multiple vulnerabilities (a711b018-a24b-11f1-81e6-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a711b018-a24b-11f1-81e6-3c7c3fba4204 advisory. NLnet Labs reports: Tenable has extracted the preceding description block directly from the...

CVE-2026-81532

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message,...

CVE-2026-81532 BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message,...

CVE-2026-81532 BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message,...

CVE-2026-81532

CVE-2026-81532 affects the MongoDB Connector for BI ODBC driver . The root cause is improper bounds checking on a positioned-cursor statement's cursor name : because the name length is not bounded before the driver builds its diagnostic message, an overly long name overwrites memory adjacent to a...