CVE-2026-93744

The IBM Navigator for i application on IBM i versions 7.3, 7.4, 7.5, and 7.6 (5770-SS1 Option 3) is vulnerable to an improper authentication flaw (CWE-287 ). An unauthenticated remote attacker can bypass security restrictions by sending a specially crafted HTTP request to any URL within the Navig...

CVE-2026-93744 IBM i Improper Authentication

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability ...

CVE-2026-91568

A vulnerability exists in the RDBMS component of Oracle Database Server versions 23.4.0-23.26.3 . A low-privileged attacker with Create Session privileges and network access via Oracle Net can exploit this flaw to compromise the RDBMS. Successful exploitation may result in unauthorized access to ...

CVE-2026-87356

A vulnerability exists in the Applications Platform Engineering product of Oracle E-Business Suite , specifically within the Valid Session component. This issue affects supported versions 12.2.3-12.2.15 . A low privileged attacker with logon access to the infrastructure where Applications Platfor...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2012-20005

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

CVE-2012-20004

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...

Cachet has Stored XSS in Incident Component

Summary A stored Cross-Site Scripting XSS vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover...

EUVD-2012-6613

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

CVE-2012-20005 SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

CVE-2012-20005

The SocialFit plugin for WordPress (versions through 1.2.2) is vulnerable to a reflected cross-site scripting (XSS) flaw due to the lack of sanitization on the msg parameter. Unauthenticated attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php using service=googleplus and m...

CVE-2012-20004 K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...

EUVD-2012-6612

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...

CVE-2012-20004

The K-news plugin for WordPress (versions prior to 1.1.1 ) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the failure to sanitize input supplied through the 'ff' parameter . Unauthenticated attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/font...

CVE-2026-113725

A flaw was found in virtualenv. The bash activation script improperly escapes the virtual environment name when configuring the command prompt. If a user activates a virtual environment created with a specially crafted name, an attacker can achieve arbitrary code execution in the user's shell...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-87864

The curl library is vulnerable to a command injection flaw when using IMAP APPEND commands with CURLOPT_CRLF enabled. The root cause is that curl advertises the raw input byte count in the IMAP APPEND {N} literal while transmitting expanded line-ending data. Consequently, the server reads only $N...

EUVD-2026-105310

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-113712

Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...