6923 matches found
CVE-2026-90298
CVE-2026-90298 affects the Linux kernel Allwinner DRM (drm/sun4i) TCON driver . The root cause is a device reference leak : the function of_find_device_by_node() acquires a device reference, which was not dropped after mux configuration succeeds. The fix, provided in the referenced kernel commits...
PT-2026-94909
Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.0 Description An issue exists in the camcc-sc8280xp clock driver where a warning is triggered when unused clocks are shut down. This occurs due to the introduction of sync state support in the clock and power domain...
PT-2026-94646
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/sun4i component where the of find device by node function takes a device reference that is not properly released. This occurs during TCON TOP device handling,...
CVE-2026-18113
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...
CVE-2026-18113
Concrete CMS 9.0 through 9.5.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Top Navigation Bar block . The block failed to HTML-escape dropdown child page names before rendering them into the page, allowing a user with page-creation or renaming privileges to inject a sc...
EUVD-2026-78904
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...
CVE-2026-18113 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...
MAL-2026-16196 Malicious code in chai-as-crack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21 Package's main entry index.js unconditionally requires./lib/config at top level, causing the file to execute on any require'chai-as-crack'...
owasp-top10-ci-pipeline
Flagship 1: Application Security Pipeline A small notes app w...
CVE-2026-18113: Improper Neutralization of Input During Web Page Generation
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...
PT-2026-92165
Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0 through 9.5.2 Description The Top Navigation Bar block fails to HTML-escape dropdown child page names before rendering them on the page. This allows a user with permissions to create or rename pages to inject a...
Astra Linux – Vulnerability in Firefox and Thunderbird
Documents in deeply-nested cross-origin browsing contexts may have obtained permissions granted to the top-level origin, bypassing the existing prompts and wrongly inheriting the top-level permissions. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...
Astra Linux – Vulnerability in Thunderbird
When receiving an email message signed with OpenPGP/MIME and containing an additional outer MIME message layer, such as a message footer added by a mailing list gateway, Thunderbird only considers the signed inner message for signature validity. This creates the false impression that the addition...
Darkly-Pentesting
Darkly A web security audit project focused on identifying an...
CLSA-2026-1789131413 tar: Fix of CVE-2026-18508
CVE-2026-18508: confine hard link targets to the --one-top-level directory, so a crafted archive can no longer alias a file outside it; this also repairs extraction of legitimate hard links under --one-top-level...
CLSA-2026-1789128477 tar: Fix of CVE-2026-18508
CVE-2026-18508: confine hard link targets to the --one-top-level directory, so a crafted archive can no longer alias a file outside it; this also repairs extraction of legitimate hard links under --one-top-level...
CVE-2026-15019
The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...
You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements
Web measurement studies rely on domain datasets such as Tranco to quantify the prevalence and impact of security issues at scale, but exhaustively analyzing these datasets is often infeasible because of the cost of advanced analysis techniques, requiring the use of sampling. Despite its widesprea...
PT-2026-89262
Name of the Vulnerable Software and Affected Versions Direct Download for WooCommerce versions prior to 1.20 Description A Directory Traversal issue exists in the top-level include function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitiv...