281388 matches found
CVE-2026-94500: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...
CVE-2026-94168: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...
PT-2026-97666
The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...
CVE-2026-95528: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
CVE-2026-94179: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...
CVE-2026-71462: Observable Response Discrepancy
StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...
CVE-2026-86934: Authorization Bypass Through User-Controlled Key
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Serv...
CVE-2026-92929: Authentication Bypass by Spoofing
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...
Linux Distros Unpatched Vulnerability : CVE-2026-91732
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged...
Linux Distros Unpatched Vulnerability : CVE-2026-91719
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security...
PT-2026-97424
Name of the Vulnerable Software and Affected Versions FileMaker Server versions prior to 26.0.3 Description An authorization bypass exists in the FileMaker Server Web Publishing Engine. By including a forged X-FMI-PE-ExtendedPrivilege header in a request, an attacker can bypass the disabled Custo...
CVE-2026-91999: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...
CVE-2026-67232: Improper Handling of Highly Compressed Data (Data Amplification)
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...
PT-2026-97584
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An unauthenticated attacker can crash a node running the...
Linux Distros Unpatched Vulnerability : CVE-2026-92005
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...
PT-2026-97587
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description The Web-MQTT handler and the Web-STOMP handler do not validate...
CVE-2026-67405: Missing Origin Validation in WebSockets
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...
PT-2026-105052
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmq web mqtt/src/rabbit web mqtt handler.erl:104 nor the Web-STOMP handler deps/rabbitmq web stomp/src/rabbit web stomp handler.erl:102 validates the...
PT-2026-105063
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max frame size, so cowboy's default of infinity...
