correctiv-chartbuilder (>=0.0.1, <=0.0.5), django-autoconfig (0.3.3) +1 more potentially affected by CVE-2026-15307 via django (1.8.0rc1)

django PYPI version 1.8.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - correctiv-chartbuilder =0.0.1, =1.0.25, =1.0.27 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924 are vulnerable to an authorization header leakage due to a shared request handler that attaches the Authorization header to outgoing requests without verifying the destination origin. An attacker can trick a user into c...

EUVD-2026-90890

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2022-33891-EXPLOIT

CVE-2022-33891 - Apache Spark UI Remote Code Execution RCE 🔐 Apache Spark UI is susceptible to a remote command injection vulnerability identified as CVE-2022-33891. This flaw arises due to improper handling of user authentication and access control, specifically when Access Control Lists ACLs ar...

Security Bulletin: Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities in IBM Cloud Pak System

Summary Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities were found in Cloud Pak SystemCVE-2026-3295, CVE-2023-38375, CVE-2026-3161,CVE-2026-4418. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...

BIT-RABBITMQ-2026-67410 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

BIT-RABBITMQ-2026-67239 RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...

BIT-RABBITMQ-2026-67237 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the...

BIT-RABBITMQ-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

CLEANSTART-2024-VW81422 Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89

Security vulnerability affects the chromium package. Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89...

CLEANSTART-2024-GG92562 Incorrect security UI in Loader in Google Chrome prior to 89

Security vulnerability affects the chromium package. Incorrect security UI in Loader in Google Chrome prior to 89...

CLEANSTART-2024-UG97969 Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90

Security vulnerability affects the chromium package. Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90...

CLEANSTART-2024-JL25216 Incorrect security UI in payments in Google Chrome on Android prior to 91

Security vulnerability affects the chromium package. Incorrect security UI in payments in Google Chrome on Android prior to 91...

CLEANSTART-2024-DD50354 Incorrect security UI in Downloads in Google Chrome on Android prior to 92

Security vulnerability affects the chromium package. Incorrect security UI in Downloads in Google Chrome on Android prior to 92...

CLEANSTART-2024-MI55100 Use after free in UI framework in Google Chrome prior to 92

Security vulnerability affects the chromium package. Use after free in UI framework in Google Chrome prior to 92...

CLEANSTART-2024-FY86673 Use after free in Browser UI in Google Chrome on Chrome prior to 92

Security vulnerability affects the chromium package. Use after free in Browser UI in Google Chrome on Chrome prior to 92...