122567 matches found
CVE-2026-82767
Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-82767
CVE-2026-82767 is a cross-site scripting (XSS) vulnerability in SGA1000 , a product associated with CONTEC (as indicated by the vendor security advisory reference). When exploited, an arbitrary script may be executed on a logged-in user's web browser. The attack vector is adjacent network with no...
CVE-2026-82767
Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
EUVD-2026-77220
Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-90619 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...
CVE-2026-90619
0x4m4 HexStrike AI (up to commit d689933ff579d839c676c82b231f8e98326c5f04 ) is affected by an OS command injection in the Execute Endpoint of the file hexstrike_server.py . An unauthenticated remote attacker can manipulate the code/script argument to inject arbitrary OS commands. The proof-of-con...
Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
CVE-2026-82769: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
PT-2026-91073
Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
PT-2026-91094
Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
PT-2026-91085
Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-82776: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
PT-2026-91075
Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-82771: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
PT-2026-91256
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf sg script load of the file scenegraph/vrml tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made publ...
PT-2026-91077
Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
ROS-20260914-73-0112
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
MAL-2026-16201 Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
PT-2026-91033
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrike server.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...