CVE-2026-95500 JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-84388

An improper restriction of rendered UI layers or frames vulnerability in Fortinet FortiPAM Chrome Extension (versions 8.0 and 7.4 , all versions) allows a remote, unauthenticated attacker to achieve information disclosure and compromise the confidentiality and integrity of protected data. Accordi...

EUVD-2026-84423

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack...

CVE-2026-84388

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack...

CVE-2026-84388

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack...

CVE-2026-95683 MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an...

CVE-2023-54356

A flaw was found in Kyverno. The software supports insecure 3DES cipher suites on its TLS endpoints. A remote attacker could exploit this vulnerability, known as the Sweet32 attack, to recover small amounts of plaintext data. This exploitation requires very long-lived TLS connections carrying lar...

CVE-2026-95675 D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

CVE-2026-95499 JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2026-95396

CVE-2026-95396 is a cross-site scripting (XSS) vulnerability in the open-source project sfturing/hosp_order , specifically in the file HospitalController.java within the Public Search Handlers component. Manipulating the Search argument leads to XSS. The attack is remotely initiated with low comp...

CVE-2026-95396 sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting

A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to cross site scripting. The attack can b...

CVE-2026-95661 MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

CVE-2026-95659 MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

MISP contains a reflected cross-site scripting XSS vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated...

CVE-2026-95273 dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...