CVE-2026-2677

Reflected Cross-Site Scripting XSS on the A3factura web platform, in parameter 'name', in 'a3factura-app.wolterskluwer.es//incomes/representatives-management' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser...

CVE-2026-2680 Multiple vulnerabilities in A3factura software

Reflected Cross-Site Scripting XSS on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es//incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser...

CVE-2026-2678

CVE-2026-2678 affects A3factura software with a Reflected XSS vulnerability in the web platform. The issue is triggered via the parameter 'name' in the endpoint a3factura-app.wolterskluwer.es/#/incomes/customers, allowing arbitrary script execution in a victim’s browser. CVSS 4.0 indicates a MEDI...

CVE-2026-2677

CVE-2026-2677 documents a reflected Cross-Site Scripting (XSS) vulnerability in the A3factura web platform. The issue occurs in the parameter 'name' for the endpoint a3factura-app.wolterskluwer.es/#/incomes/representatives-management, allowing an attacker to potentially execute arbitrary code in ...

CVE-2026-2677 Multiple vulnerabilities in A3factura software

Reflected Cross-Site Scripting XSS on the A3factura web platform, in parameter 'name', in 'a3factura-app.wolterskluwer.es//incomes/representatives-management' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser...

[SECURITY] Fedora 43 Update: firefox-148.0-1.fc43

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Wolters Kluwer A3factura 跨站脚本漏洞

Wolters Kluwer A3factura is a billing management software developed by the German company Wolters Kluwer. Wolters Kluwer A3factura has a cross-site scripting vulnerability. This vulnerability stems from a reflective cross-site scripting vulnerability in the parameter customerName of the...

PT-2026-22140

Reflected Cross-Site Scripting XSS on the A3factura web platform, in parameter 'name', in 'a3factura-app.wolterskluwer.es//incomes/representatives-management' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser...

PT-2026-22143

Reflected Cross-Site Scripting XSS on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es//incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser...

📄 Google Chrome 145.0.7632.117 DevTools Injection

A high-severity vulnerability was identified in the DevTools component of Google Chrome versions prior to 145.0.7632.117. The issue stems from an inappropriate implementation that allowed insufficient isolation between Chrome extensions and privileged DevTools pages. If a user was convinced to...

KLA90907 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. Out of bounds memory read and write vulnerability in Tint can be exploited to cause denial of service. 2. Out of...

PT-2026-22141

Reflected Cross-Site Scripting XSS on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura-app.wolterskluwer.es//incomes/customers' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser...

CVE-2025-56605

CVE-2025-56605 concerns PuneethReddyHC Event Management System 1.0. The issue is a reflected XSS in the register.php backend script where the mobile POST parameter is not sanitized and is echoed back in the HTTP response. This allows an attacker to inject and execute arbitrary JavaScript in a vic...

CVE-2026-26985

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can re...

CVE-2026-26985 LORIS vulnerable to path traversal in electrophysiology_browser

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can re...

CVE-2026-26985

CVE-2026-26985 affects LORIS 24.0.0 through versions prior to 26.0.5, 27.0.2, and 28.0.0. A authenticated user with the right permissions can abuse a path traversal flaw in the electrophysiology_browser to read server configuration files that may contain hard-coded credentials, potentially enabli...

CVE-2026-26985 LORIS vulnerable to path traversal in electrophysiology_browser

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can re...

EUVD-2026-8747

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can re...

[SECURITY] [DSA 6148-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6148-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 25, 2026 https://www.debian.org/security/faq -...

Nextcloud: Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)

A security inconsistency was identified in the useroidc app where group-based login restrictions were enforced in the browser OIDC flow but not in bearer token validation. This could have allowed users outside whitelisted groups to access the Nextcloud API with a valid bearer token...