271237 matches found
CVE-2026-79764
The web-based server management platform Termix versions 2.5.0 through 2.5.1 is vulnerable to an authenticated Server-Side Request Forgery (SSRF) . The /homepage/proxy endpoint accepts a user-provided URL and passes it to http.get or https.get without a destination allowlist. Specifically, the sr...
EUVD-2026-86230
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0...
Security Bulletin: This Power System update is being released to address CVE-2026-93306
Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web...
CVE-2026-67405
A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as usehttpauth=true for Web-STOMP or sslcertlogin=true for both plugins, an attacker can...
CVE-2026-96515
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...
github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...
When Business Email Compromise Starts Rewriting Reality
Business Email Compromise BEC operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series aroun...
CVE-2026-96515 Command Injection Vulnerability in Netlink ICT HG323RW Router
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...
EUVD-2026-85858
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...
CVE-2026-96515 Command Injection Vulnerability in Netlink ICT HG323RW Router
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...
CVE-2026-96515
The Netlink ICT HG323RW router is susceptible to a command injection vulnerability due to insufficient authorization and input validation controls within the diagnostic script import functionality . An authenticated attacker can exploit this by uploading and executing a specially crafted script v...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in the Actor component of Google Chrome prior to version 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policies through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Using use after free in Web Packaging in Google Chrome before version 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
UI misrepresentation in Web Authentication Passkeys & Security Keys in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in Controls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Improper input validation in the Network component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
In ANGLE, an uninitialized resource in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Improper initialization in the Network component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...