17970 matches found
EEF-CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms
Summary Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthenticatio...
CVE-2026-67578
FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...
CVE-2026-56705 Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...
PT-2026-81194
FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...
JetBrains TeamCity < 2019.2.2 (CVE-2020-11687)
The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages. CVE-2020-11687 Note that Nessus has not tested for this...
JetBrains TeamCity < 2020.1.5 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.5. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. CVE-2020-27628 - In JetBrains TeamCity before 2020.1.5, secure dependen...
JetBrains TeamCity < 2020.2 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2020.2. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. CVE-2021-25773 - In JetBrains TeamCity before 2020.2, an ECR token could ...
CVE-2026-56705: External Control of File Name or Path
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...
JetBrains TeamCity < 2020.1.1 (CVE-2020-15828)
The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.1. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions. CVE-2020-15828 Note that Nessus has not...
CVE-2026-71510
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...
CVE-2026-71510
Dolibarr versions prior to 24.0.0 are affected by a SQL injection in the users REST API. The root cause is that unsanitized filter parameters are spliced directly into SQL WHERE clauses without column restrictions, enabling authenticated users with user-read rights to extract sensitive data not e...
EUVD-2026-65083
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...
CVE-2026-78376 Webkitgtk: use-after-free of jscvalue function parameters
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption...
CVE-2026-78376 Webkitgtk: use-after-free of jscvalue function parameters
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: added a bounds check in dfhgetparamsize The dfhgetparamsize function can return a parameter size that is larger than the feature region, because the loop’s bounds check is evaluated before increasing the size. If the E...
CVE-2026-77115
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...