ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

CVE-2020-24972

So CVE-2020-24972 spans from another cve in actually. I don't remember the cve that got designated but it has to do with platformpluginpath cmdline option from qt. So in essence the problem comes from using qt, persee the option platformpluginpath . "This parameter is supposed to contain a...

CVE-2026-20841

CVE-2026-20841 This content corresponds to a part of what is provided through the Monthly Report for PatchPoint subscribers. Overview Microsoft disclosed a patch for an RCE vulnerability in Notepad in February 2026. The vulnerability is a Command Injection vulnerability that occurs in Notepad,...

svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...

CVE-2026-107448

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

CVE-2026-107448

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

CVE-2026-107448

The Magic: The Gathering Arena Windows/Steam client (versions 2026.59.30.12801.127931.6 and certain 2026.60.x builds) is vulnerable to a Resource Injection flaw. The application fails to validate the URI scheme or domain of a server-supplied URL received from a home-screen carousel GoToExternalUr...

EUVD-2026-94696

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

PT-2026-107802

Name of the Vulnerable Software and Affected Versions Magic: The Gathering Arena Windows/Steam client versions 2026.59.30.12801.127931.6 through 2026.60.x Description The application passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell usin...

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin, in versions prior to 2.9.3 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a failure to validate the URI scheme of user-supplied values before they are output as link targets, specifically within the Image Gallery Item UR...

PT-2026-104527

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 Description Insufficient validation of the URI scheme in a user-supplied value allows users with the contributor role and above to store a malicious payload. This payload executes ...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc (crlsa-2025_1915)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251915 advisory. emacs: Shell Injection Vulnerability in GNU Emacs via Custom man URI Scheme CVE-2025-1244 Tenable has extracted the preceding description block directly from the CI...

Rocky Linux 8 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc (crlsa-2025_1917)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251917 advisory. emacs: Shell Injection Vulnerability in GNU Emacs via Custom man URI Scheme CVE-2025-1244 Tenable has extracted the preceding description block directly from the CI...

EUVD-2026-68961

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution...

CVE-2026-95626 Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...

CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...

SUSE CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-49830: Improper Input Validation

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...