23741 matches found
CVE-2026-25615
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668...
CVE-2026-25615
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668...
CVE-2026-25614
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...
EUVD-2026-5174
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665...
CVE-2026-25616
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665...
CVE-2026-25616
Blesta CVE-2026-25616 affects Blesta versions 3.x through 5.x before 5.13.3 due to mishandling of input validation (CORE-5665). Multiple sources (Red Hat, CVE listing, PacketStorm) indicate impacts include input handling defects that enable cross-site scripting in certain endpoints, with the cano...
CVE-2026-25615
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668...
CVE-2026-25615
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668...
CVE-2026-25614
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...
CVE-2026-25614
Blesta 3.x–5.x prior to 5.13.3 is affected by an object injection vulnerability (CORE-5680). User input passed via invoices (POST) or item-ext-ref (GET) can reach unserialize() in Checkout2::validate()/Checkout2::success(), allowing arbitrary PHP objects to be injected. This enables potential rem...
CVE-2026-25614
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...
EUVD-2026-5170
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680...
CVE-2026-25503
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causin...
CVE-2026-25238
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion may allow attackers to inject SQL via a crafted email value. This issue has been patched in version 1.33.0...
CVE-2025-69419 affecting package openssl for versions less than 3.3.5-3
CVE-2025-69419 affecting package openssl for versions less than 3.3.5-3. A patched version of the package is available...
GHSA-73F3-RQQF-2J54 Apache Syncope: Console XXE on Keymaster parameters
Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs. Th...
CVE-2019-25265 Online Inventory Manager 3.2 - Persistent Cross-Site Scripting
Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie...
Docker Fixes Critical Ask Gordon AI Flaw Allowing Code Execution via Image Metadata
Cybersecurity researchers have disclosed details of a now-patched security flaw impacting Ask Gordon, an artificial intelligence AI assistant built into Docker Desktop and the Docker Command-Line Interface CLI, that could be exploited to execute code and exfiltrate sensitive data. The critical...
