31949 matches found
PT-2026-57559
Name of the Vulnerable Software and Affected Versions luci-app-upnp affected versions not specified Description Stored cross-site scripting occurs when unauthenticated LAN clients inject JavaScript through UPnP IGD AddPortMapping SOAP requests. The issue arises because the NewPortMappingDescripti...
Chromium: CVE-2026-13852 Insufficient validation of untrusted input in WebAppInstalls
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-56296
creationtimestamp| type| source ---|---|--- 2026-07-11 14:40:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqevevaz5z2z 2026-07-11 15:36:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqeyjfs3bh2x...
EUVD-2026-43170
Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transferapp RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid app IDs by observing error message differences when calling...
CVE-2026-56296
Cap-go before 12.128.2 has an information disclosure flaw in the public.transfer_app RPC that returns distinct error messages for existing versus non-existing app IDs. This enables unauthenticated attackers to enumerate valid app IDs by observing error message differences when calling transfer_ap...
CVE-2026-56296 Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC
Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transferapp RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid app IDs by observing error message differences when calling...
CVE-2026-56296 Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC
Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transferapp RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid app IDs by observing error message differences when calling...
CVE-2026-9738
creationtimestamp| type| source ---|---|--- 2026-07-11 05:35:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdwwpdlav26...
CVE-2026-3367 Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting
The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The registersetting call on line 197 lacks a sanitiz...
CVE-2026-3367
The CVE-2026-3367 entry concerns the WordPress plugin Lockme Calendars Integration (
CVE-2026-53448
creationtimestamp| type| source ---|---|--- 2026-07-10 20:28:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcye5a7lo27 2026-07-11 01:08:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdi2a3mob22...
EUVD-2026-42961
An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...
CVE-2026-51119
An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...
CVE-2026-57228
creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25...
CVE-2026-57224
creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25...
CVE-2026-56329 Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding
Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview...
cybersecurity-exam-report
Cybersecurity Exam Project: ProFTPD Exploitation and MySQL Dat...
CVE-2026-5069
creationtimestamp| type| source ---|---|--- 2026-07-10 05:39:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgptqx442d 2026-07-11 00:43:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdgnihrty2e...
CVE-2026-21053
Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox...
SUSE CVE-2026-15115
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...