CVE-2026-44746

Due to a reflected cross-site scripting XSS vulnerability in SAP NetWeaver JAVA JDBC Test Servlet, an unauthenticated attacker could craft a URL that embeds a malicious script. If a victim clicks this link, the injected input is processed during web page generation, resulting in the execution of...

CVE-2026-41706

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

Fission 路径遍历漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contained a path traversal vulnerability. This vulnerability stemmed from the Unarchive function using filepath.Join to concatenate the archive entry name with the target directory,...

Splunk Enterprise 输入验证错误漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. There is an input validation...

EUVD-2026-35635

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

EUVD-2026-35288

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the...

CVE-2026-29170

creationtimestamp| type| source ---|---|--- 2026-06-08 21:33:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnsmy6kpfq2g 2026-06-09 12:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnu7hq6yhy25 2026-06-09 18:00:00+00:00| seen|...

CVE-2026-49233

creationtimestamp| type| source ---|---|--- 2026-06-08 15:29:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnryrdiyxt2n...

UBUNTU-CVE-2026-8833

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

CVE-2026-8833

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

CVE-2026-11569

creationtimestamp| type| source ---|---|--- 2026-06-08 12:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrq5vv63p23...

CVE-2026-8833 XSS in urls

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

CVE-2026-9506

creationtimestamp| type| source ---|---|--- 2026-06-08 11:30:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrlfqxm5c2t...

CVE-2026-11491

creationtimestamp| type| source ---|---|--- 2026-06-08 06:50:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnr3qo5yhe2f...

The vulnerability of the Payments component in Google Chrome and Microsoft Edge browsers allows a hacker to manipulate the URL address bar by using a specially created HTML page.

The vulnerability of the Payments component in Google Chrome and Microsoft Edge is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to forge the URL input by using a specially created HTML page...

PT-2026-47572

AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin | Field | Value | | ---------------- | ----- | | Repository | julien040/anyquery | | Affected version | 0.4.4 commit 0abd460 | | Vulnerability | CWE-94 — Improper Control of Generation of Code | | Severity | High | Summary Th...

CVE-2026-11439

creationtimestamp| type| source ---|---|--- 2026-06-06 20:50:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnnjregbbn2m...

CVE-2026-9280 Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-62317

HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosure under certain conditions...

CVE-2026-27949

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling e.g., when an invalid magic code is submitted. Transmitting personally...