PHP cross-site scripting vulnerabilities

PHP is an open-source scripting language executed on the server side. Versions of PHP prior to 8.2.31, 8.3.31, 8.4.21, and 8.5.6 had a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of user data, allowing attackers to construct URLs that allowed arbitrary...

CVE-2026-6735: Improper Neutralization of Input During Web Page Generation

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

CVE-2022-50963: Improper Neutralization of Input During Web Page Generation

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/active module. The datecreated, datefrom, dateto, and createdat parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via...

CVE-2026-45347

creationtimestamp| type| source ---|---|--- 2026-05-09 22:47:27+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-f776-fp4w-266c 2026-05-16 00:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlwmx6fwfz2t...

CVE-2026-8195

creationtimestamp| type| source ---|---|--- 2026-05-09 22:00:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhalbqgdr2e...

CVE-2026-8234

creationtimestamp| type| source ---|---|--- 2026-05-09 16:45:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116545626763451374 2026-05-10 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116549106106707429 2026-05-10 07:30:28+00:00| seen|...

Exploit for Write-what-where Condition in Linux Linux_Kernel

Dirty Frag check CVE-2026-43284 / CVE-2026-43500 Read-only...

OESA-2026-2209 postfix security update

Postfix is a Mail Transport Agent MTA. Security Fixes: Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.CVE-2026-43964...

GHSA-2F25-PFQ3-C7H8

creationtimestamp| type| source ---|---|--- 2026-05-09 06:10:29+00:00| seen| https://gist.github.com/alon710/5630cef7c3595002259238662d69e7b6...

CVE-2026-42174

creationtimestamp| type| source ---|---|--- 2026-05-09 05:02:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfhpvrzss2k...

CVE-2026-8207

creationtimestamp| type| source ---|---|--- 2026-05-09 04:52:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfh6k6yu52c...

GHSA-G8R3-5HWF-QP96 epa4all-client has a VAU Signature bypass

Impact In SignedPublicKeysTrustValidatorImpl.isTrusted, the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify. The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually...

CVE-2026-42213

creationtimestamp| type| source ---|---|--- 2026-05-08 23:24:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleuu7yjok2o...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-42215 +1 more via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-42215, CVE-2026-67326 Source advisory:...

CVE-2026-41588

creationtimestamp| type| source ---|---|--- 2026-05-08 17:43:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlebsdnqbg2t 2026-05-08 18:46:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlefcwic3y2t 2026-05-12 22:07:07+00:00| seen|...

CVE-2026-43472

creationtimestamp| type| source ---|---|--- 2026-05-08 17:08:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116540052992107234 2026-05-09 16:06:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116545473383071089 2026-08-03 07:13:46+00:00| seen|...

CVE-2026-41886

creationtimestamp| type| source ---|---|--- 2026-05-08 17:07:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mle7qhnbjg2w...

CVE-2026-43380

creationtimestamp| type| source ---|---|--- 2026-05-08 16:28:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116539895668179070 2026-08-03 07:45:11+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260803...

CLSA-2026-1778254552 httpd: Fix of 8 CVEs

CVE-2026-24072: modrewrite/modsetenvif: use APEXPRFLAGRESTRICTED in htaccess to prevent reading server-side files via apexpr from .htaccess - CVE-2026-29169: moddavlock: NULL pointer dereference in davgenericrefreshlocks use dpscan instead of dp - CVE-2026-33006: modauthdigest: timing attack —...

EUVD-2026-28566

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky NIX SQ manager sticky mode is known to cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE may deadlock on transitions between stick...