DRUPAL-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

PT-2026-60354

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Description Drupal core contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. The XSS filter does not...

CVE-2024-24912

A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system...

CVE-2024-38865

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 EOL allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for ...

CVE-2020-1803

Huawei smartphones Honor V20 with versions earlier than 10.0.0.179C636E3R4P3,versions earlier than 10.0.0.180C185E3R3P3,versions earlier than 10.0.0.180C432E10R3P4 have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in...