EUVD-2026-105106

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to...

CVE-2026-113703

SuggestArr versions prior to 3.0.0 are vulnerable to an authentication bypass in the local_bypass mode. The root cause is located in api_service/auth/middleware.py, where the enforce_authentication() function trusts the request.remote_addr value. This value is derived from a spoofable X-Forwarded...

CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to...

CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to...

CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to...

Malicious code in test-workalendar-internal (PyPI)

Source: kam193 9f36e976d0fcf254def6da62e0090bfb2dbdf76176ed316655574408c25cb9a0 During build, the package creates a web-sharable terminal session and exposes it via a Cloudflare tunnel to the attacker. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

CVE-2026-113583

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

EUVD-2026-104966

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

CVE-2026-11959

Stored Cross-Site Scripting XSS in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

EUVD-2026-104833

Stored Cross-Site Scripting XSS in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

CVE-2026-11959 Multiple vulnerabilities in FacturaScripts

Stored Cross-Site Scripting XSS in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

CVE-2026-11959

The software FacturaScripts , version 2025.61 , is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient validation or sanitization of user input. The flaw exists in the 'city' and 'province' fields within the 'ListAlmacen' endpoint. An attacker can exploit this to execute arbitrary...

CVE-2023-35794-WebSSH-Hijacking

CVE-2023-35794-WebSSH-Hijacking Repository contains description for CVE-2023-35794 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-35794 Vendor: Cassia Networks Product: Access Controller Version: Cassia-AC-2.1.1.2303271039 Vulnerability: Incorrect Access Control...

EUVD-2026-104676

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session...

EUVD-2025-211135

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2026-107366

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session...

VulnCheck KEV: CVE-2012-20004

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...

VulnCheck KEV: CVE-2012-20005

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

PT-2026-120134

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability ...