31054 matches found
CVE-2026-67352
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
EUVD-2026-51867
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
CVE-2026-67352
CVE-2026-67352 affects luci-app-https-dns-proxy. A stored XSS flaw exists in the resolver_url parameter; authenticated users can inject active HTML, which is rendered as raw HTML on the HTTPS DNS Proxy status page and can execute JavaScript in the admin’s browser origin. Documents provide CVSS me...
modoboa 2.0.4 - Admin TakeOver
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...
CVE-2026-15006
creationtimestamp| type| source ---|---|--- 2026-08-01 04:12:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fjzicctxlhcte 2026-08-01 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mryn3ucp2a2b 2026-08-01 13:00:52+00:00| seen|...
EUVD-2026-44802
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE...
CVE-2026-17349
creationtimestamp| type| source ---|---|--- 2026-07-31 17:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgmxn3vz2s 2026-08-01 09:38:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz6clkjkg24 2026-08-01 09:38:47+00:00| seen|...
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise...
CVE-2026-12562
creationtimestamp| type| source ---|---|--- 2026-07-31 09:19:37+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrwmrz4q652w 2026-07-31 12:10:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrwwcsfwf22j 2026-08-02 22:00:47+00:00| seen|...
Adlisting Classified Ads 2.14.0 - Information Disclosure
Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects. id: CVE-2023-4168 info: name: Adlisting Classified Ads 2.14.0 - Information Disclosure autho...
CVE-2026-55502
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...
EUVD-2026-51381
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...
SUSE CVE-2026-17793
Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
EUVD-2026-51331
An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...
CVE-2026-18064
CVE-2026-18064 affects NASA’s core Flight System (cFS) Health and Safety (HS) application. The issue is an incomplete fix for CVE-2026-15352, leaving a separate NULL pointer dereference exploitable in HS versions up to and including 7.0.1. A successful trigger of the affected command under specif...
SUSE CVE-2026-45627
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution...
SUSE CVE-2026-55430
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from httpapi.RequestHost which prefers the X-Forwarded-Host header over the real Host header. No middleware...
SUSE CVE-2026-55431
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...
CVE-2026-15435
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...