CVE-2026-9592 Sensitive Information Disclosure in HTTP header

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header...

CVE-2026-9592 Sensitive Information Disclosure in HTTP header

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header...

CVE-2026-9592

SEPPmail Secure Email Gateway & SEPPmail Cloud prior to 15.0.4.2 are vulnerable. The issue arises because the session token is disclosed in the URL and an HTTP header within the GINA web portal, allowing an attacker to replay and hijack a user session. Affected component: GINA web portal session ...

PT-2026-60809

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalid browser and invalid browser login handlers. User-supplied data is reflected into...

CVE-2026-9592: Use of GET Request Method With Sensitive Query Strings

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header...

CVE-2026-9585: Improper Neutralization of Input During Web Page Generation

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...

SAP NetWeaver Enterprise Portal XSS (3746678)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3746678: - SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. T...

Malicious code in @funny-booth/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4 The package ships heavily obfuscated runtime files dist/index.js, dist/launcher.js built with javascript-obfuscator. The MCP server registered as the...

MAL-2026-10711 Malicious code in @funny-booth/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4 The package ships heavily obfuscated runtime files dist/index.js, dist/launcher.js built with javascript-obfuscator. The MCP server registered as the...

EUVD-2026-44872

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level self-registerable account to perform SQL injection attacks...

CVE-2026-12395

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level self-registerable account to perform SQL injection attacks...

CVE-2026-12395

The WP Job Portal WordPress plugin, in versions prior to 2.5.5 , contains a vulnerability where a parameter is not properly sanitized or escaped before being used in a SQL query. This flaw allows authenticated users with a subscriber-level (self-registerable) account to perform SQL injection atta...

CVE-2026-12395 WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level self-registerable account to perform SQL injection attacks...

CVE-2026-12395: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level self-registerable account to perform SQL injection attacks...

Improper Authorization

Apollo Portal is vulnerable to Improper Authorization. The vulnerability is due to missing application and namespace permission checks when retrieving releases by ID, which allows an authenticated low-privileged user to access unauthorized release data by supplying a valid release ID...

CVE-2025-32781

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

CVE-2025-32781

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

EUVD-2025-210473

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...