6600 matches found
C-MOR 6.0104 Cross Site Scripting
C-MOR Video Surveillance versions 6.0104 and below suffer from a cross site scripting vulnerability. Exploit Title: C-MOR 6.0104 - Cross-Site Scripting XSS Google Dork: N/A Date: 2026-07-23 Exploit Author: Samir Shamdin Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link:...
Linux Distros Unpatched Vulnerability : CVE-2026-33245
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components RSC APIs, there is a potential...
C-MOR 6.0104 - Cross-Site Scripting (XSS)
Exploit Title: C-MOR 6.0104 - Cross-Site Scripting XSS Google Dork: N/A Date: 2026-07-23 Exploit Author: Samir Shamdin Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link: https://www.c-mor.com/ Version: = 6.0104 Tested on: C-MOR Video Surveillance V6.0104 CVE: CVE-2026-51133 1...
Actor Component DoS
The vulnerability of the Actor component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...
Extensions Component Data Compromise
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...
Extensions Component Data Compromise
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...
DevTools DoS
The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
Extensions Component Data Compromise
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...
OESA-2026-3567 openssh security update
An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...
OESA-2026-3566 openssh security update
An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...
OESA-2026-3565 openssh security update
An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
Summary A SQL injection is possible when the connector escapes Buffer parameters client-side under a multi-byte client character set whose trail-byte range overlaps the ASCII backslash 0x5C: big5, gbk, sjis, cp932, and gb18030. Under these charsets, an attacker-controlled lead byte can absorb the...
CVE-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...
CVE-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...
CVE-2026-55855
MariaDB Connector/Node.js is vulnerable to SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 character sets. The root cause is in PacketOutputStream.writeBufferEscape (lib/io/packet-output-stream.js), which escaped bytes ...
EUVD-2026-66110
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the site navigation custom URL process. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious code. Details Cross-site scripting or XSS is a code vulnerability...
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...
GHSA-2WVM-8MVP-22QV Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...
