1243826 matches found
CVE-2026-7174
CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...
Security Bulletin: Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities in IBM Cloud Pak System
Summary Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities were found in Cloud Pak SystemCVE-2026-3295, CVE-2023-38375, CVE-2026-3161,CVE-2026-4418. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...
Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838
Summary IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Detai...
EUVD-2026-90744
CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...
CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...
EUVD-2026-90743
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...
CVE-2026-7173
The Entradium platform by Crocantickets contains Cross-Site Scripting (XSS) vulnerabilities. A Stored XSS exists in the City parameter of the /events//edit_general endpoint, allowing JavaScript injection that executes on an event's public page when editing events assigned to a promoter. Additiona...
Security Bulletin: Due to use of WebSphere Application Server - Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities.
Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...
BIT-RABBITMQ-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...
CVE-2026-15983
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...
CLEANSTART-2024-EV00180 Inappropriate implementation in Site isolation in Google Chrome prior to 89
Security vulnerability affects the chromium package. Inappropriate implementation in Site isolation in Google Chrome prior to 89...
CLEANSTART-2025-OQ04236 Cross Site Scripting (XSS) vulnerability exists in Gitea before 1
Security vulnerability affects the gitea package. Cross Site Scripting XSS vulnerability exists in Gitea before 1...
CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms
MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...
CVE-2026-103662
A reflected cross-site scripting (XSS) vulnerability exists in the MISP legacy taxonomy tag management confirmation forms (specifically the add tag and disable tag forms). The flaw is caused by the application echoing a user-supplied tag name value from the request into the rendered HTML output w...
EUVD-2026-90577
MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...
CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms
MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...
CVE-2026-100184 Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...
EUVD-2026-90563
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...
CLEANSTART-2024-SC89971 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities
Security vulnerability affects the drupal7 package. Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...