1928 matches found
NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization vulnerability discovered by ? in WordPress Npm fabric versions 7.4.0...
WordPress Schema & Structured Data for WP & AMP plugin < 1.60 - Unauthenticated Arbitrary Media Upload vulnerability
Unauthenticated Arbitrary Media Upload vulnerability discovered by 0xBassia in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.60...
CVE-2026-20251
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or...
CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls,...
CVE-2026-10721 Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7...
CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1
CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-25680 affecting package docker-compose for versions less than 2.27.0-13
CVE-2026-25680 affecting package docker-compose for versions less than 2.27.0-13. A patched version of the package is available...
CVE-2026-46598 affecting package docker-compose for versions less than 2.27.0-13
CVE-2026-46598 affecting package docker-compose for versions less than 2.27.0-13. A patched version of the package is available...
PT-2026-48495
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious classic dashboard that...
CVE-2026-8327
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...
CVE-2026-41058
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink of arbitrary files via ../../ sequences in the GET parameter. Commit...
CVE-2026-39882 affecting package containerd2 for versions less than 2.2.4-2
CVE-2026-39882 affecting package containerd2 for versions less than 2.2.4-2. A patched version of the package is available...
CVE-2026-6276 affecting package curl for versions less than 8.11.1-7
CVE-2026-6276 affecting package curl for versions less than 8.11.1-7. A patched version of the package is available...
CVE-2026-41526 affecting package kf-kcoreaddons for versions less than 5.249.0-2
CVE-2026-41526 affecting package kf-kcoreaddons for versions less than 5.249.0-2. A patched version of the package is available...
CVE-2026-5172 affecting package dnsmasq for versions less than 2.92-1
CVE-2026-5172 affecting package dnsmasq for versions less than 2.92-1. A patched version of the package is available...
CVE-2026-40356 affecting package krb5 for versions less than 1.21.3-4
CVE-2026-40356 affecting package krb5 for versions less than 1.21.3-4. A patched version of the package is available...
CVE-2025-12432 affecting package nodejs for versions less than 24.14.1-3
CVE-2025-12432 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2026-33814 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5
CVE-2026-33814 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5. A patched version of the package is available...
CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5
CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5. A patched version of the package is available...