org.apache.cxf/cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

org.apache.cxf/cxf: Apache CXF: Authorization Code Replay via Race Condition

A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized...

cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

org.apache.cxf/cxf: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider

A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the removeCodeGrant functionality, which fails to properly invalidate used...

CVE-2026-82566 Botslab G980H Dashcams Insufficient session expiration

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing...

CVE-2026-61823

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823

The code16 Sharp framework (a Laravel-based CMS/admin interface) is vulnerable to stored cross-site scripting (XSS) in versions prior to 9.22.5 . The root cause is that the rich-text editor's HTML sanitizer allows the srcdoc attribute on iframe elements. While the sanitizer HTML-encodes the inter...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

Malicious code in analytics-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b78f3ed716380da74c5d54de6e24b6b128536a7ce5772e8b05d03108a1d9b74 The package is published as 'analytics-widget' with an empty description, but its main module contains no analytics functionality. On load, index.js...

MAL-2026-17163 Malicious code in analytics-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b78f3ed716380da74c5d54de6e24b6b128536a7ce5772e8b05d03108a1d9b74 The package is published as 'analytics-widget' with an empty description, but its main module contains no analytics functionality. On load, index.js...

CVE-2026-4637

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

EUVD-2026-85840

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-4637

Paessler PRTG Network Monitor (versions before 26.2.120.1449 ) is vulnerable to a reflected Cross-Site Scripting (XSS) flaw. The issue occurs because the web interface returns an HTTP 403 "Forbidden Path" error page for non-existent resources ending in ".htm" and echoes the requested URL path int...

CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

EUVD-2026-85774

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-61823: Improper Neutralization of Input During Web Page Generation

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...