PT-2026-56202

Name of the Vulnerable Software and Affected Versions phoenix versions 1.2.0-rc.0 through 1.5.14 phoenix versions 1.6.0-rc.0 through 1.6.16 phoenix versions 1.7.0-rc.0 through 1.7.23 phoenix versions 1.8.0-rc.0 through 1.8.8 Description The Presence JavaScript client in phoenix contains an improp...

GHSA-24X4-J6X9-RFW5 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Summary An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session...

@conform-to/react (>=1.8.0, <=1.19.3), @conform-to/valibot (>=1.8.0, <=1.19.3) +4 more potentially affected by CVE-2026-49250 via @conform-to/dom (>=1.8.0, <=1.19.3)

@conform-to/dom NPM version =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.17.1-depup.0, =1.17.1-depup.0, =1.18.0-depup.0 Source cves: CVE-2026-49250 Source advisory: SNYK:JS-CONFORMTODOM-17812748...

@conform-to/react (>=1.8.0, <=1.19.3), @conform-to/valibot (>=1.8.0, <=1.19.3) +4 more potentially affected by CVE-2026-49250 via @conform-to/dom (>=1.8.0, <=1.19.3)

@conform-to/dom NPM version =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.17.1-depup.0, =1.17.1-depup.0, =1.18.0-depup.0 Source cves: CVE-2026-49250 Source advisory: OSV:GHSA-525M-7F82-2MF7...

The vulnerability of Google Chrome and Microsoft Edge browser password managers allows attackers to bypass security restrictions.

The vulnerability of Google Chrome and Microsoft Edge browser password managers is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

oras-go blob upload vulnerable to credential forwarding via unvalidated Location header

Summary oras-go follows a registry-controlled Location header during the monolithic blob upload flow and reuses the Authorization header from the initial POST request for the subsequent PUT request. If a malicious registry returns a cross-host Location, oras-go can send the caller's credentials t...

GHSA-2V4M-FW6C-G78F GeoNetwork has reflected XSS through client-side template injection

Summary It is possible to craft a URL that causes GeoNetwork to reflect attacker-controlled content into an error page in a way that gets evaluated as a client-side template expression. Combined with known AngularJS sandbox-escape techniques, this can be used to execute arbitrary JavaScript in th...

CVE-2026-53909

MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor contact attempts were unsuccessful, th...

EUVD-2026-40955

MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor contact attempts were unsuccessful, th...

CVE-2026-53909

MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor contact attempts were unsuccessful, th...

CVE-2026-53909

CVE-2026-53909 affects MCO where file upload validation relies solely on client-side checks, allowing an authorized low-priv attacker to upload arbitrary file types to the server. The vulnerability has been confirmed only in version 25.3.3.1, though other versions may also be affected. The docume...

CVE-2026-53909 Arbitrary File Upload in MCO

MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor contact attempts were unsuccessful, th...

CVE-2026-53909 Arbitrary File Upload in MCO

MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor contact attempts were unsuccessful, th...

PT-2026-54835

Name of the Vulnerable Software and Affected Versions MCO version 25.3.3.1 Description The software fails to correctly validate the types of uploaded files because the validation process relies exclusively on client-side checks, which can be bypassed. This allows an authorized, low-privileged...

CVE-2025-36327

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of sever-side security...

CVE-2025-36327 Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of sever-side security...

EUVD-2025-210378

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of sever-side security...

CVE-2025-36327 Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of sever-side security...

CVE-2025-36327

CVE-2025-36327 affects IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, and 5.3.0. An authenticated user can bypass security controls and perform unauthorized actions due to client-side enforcement of server-side security. The issue is described as a failure of client-side controls to enforce s...

CVE-2026-58015

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...