CVE-2026-48954: Improper Neutralization of Input During Web Page Generation

Improper validation leads to a generic XSS vector in the language override feature...

CVE-2026-48955: Improper Access Control

An improper access check allows unauthorized users to access workflow stage and transition information...

CVE-2026-48950: Improper Neutralization of Input During Web Page Generation

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

CVE-2026-48949: Improper Neutralization of Input During Web Page Generation

Lack of validation leads to an XSS vulnerability in the MFA management views...

CVE-2026-48948: Improper Access Control

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-12352: Incorrect Authorization

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...

CVE-2026-13696: Improper Neutralization of Special Elements used in an LDAP Query

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MYS: before release.Master.1107...

CVE-2026-11348: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107...

CVE-2026-8377: Missing Authorization

Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System GKS allows Collect Data from Common Resource Locations. This issue affects Access Control System GKS: before Version 2...

CVE-2026-8306: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System GKS allows Stored XSS. This issue affects Access Control System GKS: before Version 2...

CVE-2026-7380: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Armiya Information Technologies Ltd. Co. Access Control System GKS allows XSS Targeting HTML Attributes. This issue affects Access Control System GKS: before Version 2...

CVE-2026-5799: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026...

CVE-2026-49033: Stack-based Buffer Overflow

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code...

Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Metasploit Scanner

This Metasploit auxiliary module scans for a potential authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway services...

CVE-2026-48956: Improper Access Control

An improper access check allows users to display a list of modules in the frontend...

CVE-2026-48947: Improper Access Control

An improper access check allows privileged users to overwrite media files without editing permissions...

CVE-2026-48952: Improper Neutralization of Input During Web Page Generation

Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...

[SECURITY] Fedora 43 Update: rust-wayland-scanner-0.31.10-3.fc43

Wayland Scanner for generating rust APIs from XML wayland protocol files...

[SECURITY] Fedora 44 Update: rust-wayland-scanner-0.31.10-3.fc44

Wayland Scanner for generating rust APIs from XML wayland protocol files...

MAL-2026-6795 Malicious code in zod-pino444 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 560c3d47344d4da5dffac230236b5248d2f1856c221ffac7ff72d4e3b197957b Package [email protected] is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-agent.mjs is a...