Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

EUVD-2026-70503

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

PT-2026-85074

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the...

PT-2026-85066

Name of the Vulnerable Software and Affected Versions Google Cloud KMS affected versions not specified Description An unauthorized user with key vault write access can trick an authorized client into making arbitrary authenticated Google Cloud KMS API calls using the authorized user's identity...

CVE-2026-84841

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

EUVD-2026-70255

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841

tsi-coop tsi-dpdp-cms versions up to 0.5.0 contain a flaw where server-side security is enforced only on the client side , allowing a remote, unauthenticated attacker to bypass authentication via direct HTTP requests. The exploit has been published as a proof-of-concept (see exploit repository )....

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

Livewire DOM-based cross-site scripting during client-side state handling

Impact In Livewire v3 ≤ 3.8.2 and v4 ≤ 4.3.3, a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affec...

EUVD-2026-68765

Livewire DOM-based cross-site scripting during client-side state handling...

GHSA-G3HC-697W-WM82 Livewire DOM-based cross-site scripting during client-side state handling

Impact In Livewire v3 ≤ 3.8.2 and v4 ≤ 4.3.3, a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affec...

Prototype Pollution

Overview livewire/livewire is an A front-end framework for Laravel. Affected versions of this package are vulnerable to Prototype Pollution in the client-side state handling process. An attacker can execute arbitrary JavaScript in the context of the affected application by tricking a user into...

CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...