CVE-2026-17045 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

CVE-2026-17045

CVE-2026-17045 affects IBM i 7.6, 7.5, 7.4, and 7.3 due to improper session management that can allow a remote authenticated attacker to perform unauthorized operations and access sensitive information. The vulnerability is categorized under CWE-294 (Authentication Bypass by Capture-replay) with ...

CVE-2026-16713

IBM Documentation Offline 1.0.0–1.4.1 is affected by CVE-2026-16713, a security misconfiguration where the embedded Node.js server binds to an unrestricted IP address, enabling a remote attacker on the network to obtain sensitive information. The IBM bulletin (and NVD entry) describe this as an i...

CVE-2026-16713 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address...

CVE-2026-73037

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-49864

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log,...

CVE-2026-49864 wetty vulnerable to DOM XSS via file-download filename

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log,...

EUVD-2026-58243

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531

The CVE concerns django-helpdesk prior to 2.3.3, where a stored XSS vulnerability exists via HTML attachments or HTML-formatted emails submitted through public ticket channels. The root cause is insufficient sanitization and insecure Content-Disposition handling at the attachment-serving layer, e...

CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

EUVD-2026-58196

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56750

CVE-2026-56750 describes a vulnerability in Gitea where Remember-Me tokens fail to invalidate prior attacker sessions, enabling session persistence after compromise. The root cause is described as deficiencies in access control, potentially enabling privilege-related impact. Publicly documented i...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...