Lucene search
+L

29848 matches found

NVD
NVD
added 2026/01/22 5:16 p.m.9 views

CVE-2025-68869

Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through = 1.2.37...

9.8CVSS0.00423EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/01/22 4:52 p.m.16 views

CVE-2025-68898 WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through = 1.5...

5.8CVSS5.9AI score0.00148EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/01/22 4:52 p.m.7 views

CVE-2025-68898

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through = 1.5...

5.8CVSS5.3AI score0.00148EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/01/22 4:52 p.m.29 views

CVE-2025-68898 WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through = 1.5...

5.8CVSS0.00148EPSS
SaveExploits0References1
CVE
CVE
added 2026/01/22 4:52 p.m.24 views

CVE-2025-68898

The CVE-2025-68898 issue is a Stored XSS in Synergy Project Manager (WordPress plugin) versions up to and including 1.5, caused by improper input handling during web page generation. Based on connected records, there is no published fix in the provided sources; patch/status shows as Unpatched. Af...

5.8CVSS5.4AI score0.00148EPSS
SaveExploits0References1
ICS
ICS
added 2026/01/22 7:00 a.m.14 views

Delta Electronics DIAView

RISK EVALUATION Successful exploitation of this vulnerability could enable an attacker to execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact...

9.8CVSS6.2AI score0.0138EPSS
SaveExploits0References10
NVD
NVD
added 2026/01/22 4:16 a.m.18 views

CVE-2026-24055

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

6.3CVSS0.00397EPSS
SaveExploits2References4
Vulnrichment
Vulnrichment
added 2026/01/22 3:31 a.m.4 views

CVE-2026-24037 Horilla HRM has XSS Bypass through Project Name

Horilla is a free and open source Human Resource Management System HRMS. In version 1.4.0, the hasxss function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to...

4.8CVSS5.3AI score0.00227EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/01/22 3:31 a.m.32 views

CVE-2026-24037 Horilla HRM has XSS Bypass through Project Name

Horilla is a free and open source Human Resource Management System HRMS. In version 1.4.0, the hasxss function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to...

4.8CVSS0.00227EPSS
SaveExploits1References2
OSV
OSV
added 2026/01/22 3:31 a.m.10 views

CVE-2026-24037 Horilla HRM has XSS Bypass through Project Name

Horilla is a free and open source Human Resource Management System HRMS. In version 1.4.0, the hasxss function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to...

4.8CVSS5.4AI score
SaveExploits0References4
CVE
CVE
added 2026/01/22 3:31 a.m.28 views

CVE-2026-24037

Horilla HRMS has_XSS bypass in version 1.4.0 due to incomplete, context-agnostic regex filtering in has_xss(), enabling attackers to redirect users, run external JavaScript, and steal CSRF tokens for admin-targeted CSRF attacks. The issue is fixed in version 1.5.0. Affected: Horilla 1.4.x → fixed...

5.4CVSS5.3AI score0.00227EPSS
SaveExploits1References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/01/22 3:07 a.m.3 views

CVE-2026-24055

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

6.3CVSS5.4AI score0.00397EPSS
SaveExploits2References5Affected Software1
EUVD
EUVD
added 2026/01/22 3:07 a.m.11 views

EUVD-2026-4216

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

6.3CVSS5.6AI score0.00397EPSS
SaveExploits2References4
OSV
OSV
added 2026/01/22 3:07 a.m.10 views

CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

6.3CVSS5.6AI score
SaveExploits0References6
CVE
CVE
added 2026/01/22 3:07 a.m.39 views

CVE-2026-24055

Langfuse Slack OAuth installation endpoint (/api/public/slack/install) in versions

6.3CVSS5.6AI score0.00397EPSS
SaveExploits2References4Affected Software1
Vulnrichment
Vulnrichment
added 2026/01/22 3:07 a.m.5 views

CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

6.3CVSS5.6AI score0.00397EPSS
SaveExploits2References4
Cvelist
Cvelist
added 2026/01/22 3:07 a.m.29 views

CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

6.3CVSS0.00397EPSS
SaveExploits2References4
OSV
OSV
added 2026/01/22 2:15 a.m.17 views

CVE-2025-27380

HTML injection in Project Release in Altium Enterprise Server AES 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content...

7.6CVSS6AI score0.00237EPSS
SaveExploits0References1
NVD
NVD
added 2026/01/22 2:15 a.m.10 views

CVE-2025-27380

HTML injection in Project Release in Altium Enterprise Server AES 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content...

7.6CVSS0.00237EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/01/22 1:28 a.m.3 views

CVE-2025-27380 HTML Injection Leading to Script Execution in Altium Enterprise Server

HTML injection in Project Release in Altium Enterprise Server AES 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content...

7.6CVSS5.9AI score0.00237EPSS
SaveExploits0References1
Rows per page
Query Builder