27163 matches found
Access Control Bypass
Overview DIRAC is an interware, meaning a software framework for distributed computing. Affected versions of this package are vulnerable to Access Control Bypass via the setPilotStatus function and related database operations. An attacker can modify or access unauthorized database records by...
CVE-2026-35210
creationtimestamp| type| source ---|---|--- 2026-07-13 18:30:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd5omnae2f 2026-07-16 08:05:36+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnubw7r2i...
NukeViet: Unauthenticated Reflected XSS in Comment Module
Summary Reflected XSS in the Comment module via the statuscomment URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript that is decoded server-side and rendered unescaped into the page. Compounded by a second flaw: the checkss anti-forgery token was derived from ...
GHSA-MXPF-QGG6-V3FF NukeViet: Unauthenticated Reflected XSS in Comment Module
Summary Reflected XSS in the Comment module via the statuscomment URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript that is decoded server-side and rendered unescaped into the page. Compounded by a second flaw: the checkss anti-forgery token was derived from ...
Cross-site Scripting (XSS)
Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the statuscomment parameter, which is base64-decoded and rendered unescaped into the page. An attacker can execute arbitrary JavaScript in the...
GHSA-RWCV-WHM8-FMXM
creationtimestamp| type| source ---|---|--- 2026-07-13 17:11:49+00:00| seen| https://gist.github.com/alon710/1cf437e22a892172012205a9b0e24d57...
Malicious Package
Overview nodemon-async is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Kiwi TCMS's /init-db/ page renders and responds to requests after first use
Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use. ImpactThe /init-db/ page does not require any user...
CVE-2026-22093
creationtimestamp| type| source ---|---|--- 2026-07-13 11:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjkhgrukm2t 2026-07-13 17:49:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkavfwvjs2y 2026-07-14 03:05:48+00:00| seen|...
CERTFR-2026-CTI-004
creationtimestamp| type| source ---|---|--- 2026-07-13 09:25:58+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116911948082559856...
MINI-QHQ7-77WW-6CFC
Bulletin has no description...
CVE-2026-4769
creationtimestamp| type| source ---|---|--- 2026-07-13 07:21:18+00:00| seen| https://infosec.exchange/users/certvde/statuses/116911458109125585 2026-07-13 07:54:49+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqj7nsuneh2l 2026-07-13 08:30:05+00:00| seen|...
MINI-65GC-X3VQ-FWH6
Bulletin has no description...
PT-2026-57973
Name of the Vulnerable Software and Affected Versions NukeViet affected versions not specified Description Reflected Cross-Site Scripting XSS exists in the Comment module. The issue occurs because the status comment parameter accepts base64-encoded HTML or JavaScript that is decoded server-side a...
Botan X509 Path Validation Handler OCSP Forgery
The vulnerability of the X509 Path Validation Handler component in the C++ Botan cryptographic library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to forge OCSP responses remotely...
PT-2026-58978
Summary Reflected XSS in the Comment module via the status comment URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript that is decoded server-side and rendered unescaped into the page. Compounded by a second flaw: the checkss anti-forgery token was derived from...
MINI-92PV-4QV5-XMJ9
Bulletin has no description...
MINI-V3FV-VRJG-9J63
Bulletin has no description...