GHSA-64RR-PP78-62WW NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

Impact NukeViet CMS , which are stored server-side and executed in the browser of any user who views the content. Who is impacted: - Administrators and moderators who view user-submitted content e.g., contact messages, comments, or any module using the Request class for HTML input. - The Contact...

openbabel:fuzz_molecule: Stack-buffer-overflow in OpenBabel::OBMol::GetSpacedFormula

Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5668980231831552 Project: openbabel Fuzzing Engine: afl Fuzz Target: fuzzmolecule Job Type: aflasanopenbabel Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address:...

tensorflow:[email protected]: Heap-buffer-overflow in std::__1::pair<google::protobuf::Map<std::__1::basic_string<char, std::__1::char

Detailed Report: https://oss-fuzz.com/testcase?key=5381387644633088 Project: tensorflow Fuzzing Engine: libFuzzer Fuzz Target: [email protected] Job Type: libfuzzerasantensorflow Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

openbabel:fuzz_molecule: Segv on unknown address in std::__1::basic_ostream<char, std::__1::char_traits<char>>::sentry::sentry

Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5357831149912064 Project: openbabel Fuzzing Engine: afl Fuzz Target: fuzzmolecule Job Type: aflasanopenbabel Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

ffmpeg:ffmpeg_AV_CODEC_ID_SANM_fuzzer: Heap-buffer-overflow in codec47_block

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5024854725427200 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDSANMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

matio:matio_struct_cell_fuzzer: Heap-buffer-overflow in Mat_VarGetStructsLinear

Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=4617982608474112 Project: matio Fuzzing Engine: afl Fuzz Target: matiostructcellfuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: Heap-buffer-overflow WRITE...

Propfind requests for file comments allowed to load comments for other files

None...

Exploit for CVE-2026-8181

EN: Controlled PoC and brief technical notes for authorized secu...

PT-2026-41388

Name of the Vulnerable Software and Affected Versions NukeViet CMS versions prior to 4.5.08 Description Stored Cross-Site Scripting XSS occurs due to insufficient server-side input sanitization in the Request class. The application relies on client-side filtering to sanitize HTML tags and...

PT-2026-41711

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description A spoofing issue in Microsoft Edge Chromium-based allows attackers to affect the system. This includes a universal cross-site scripting XSS flaw—a type of vulnerability...

PT-2026-41710

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper input validation in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network. This issue is related to an origi...

PT-2026-41712

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions prior to 148.0.3967.70 Description A remote code execution issue exists in Microsoft Edge Chromium-based due to improper input validation within the browser's rendering pipeline and JavaScript engine. Specifically, the...

WordPress plugin Classified Listing – AI-Powered Classified ads & Business Directory Plugin 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-41260

Name of the Vulnerable Software and Affected Versions mlflow versions prior to 3.10.0 Description An authentication bypass occurs when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authenticatio...

PT-2026-41395

Name of the Vulnerable Software and Affected Versions epa4all-client versions prior to 1.2.2 Description An attacker positioned on the network path between the ePA service and the Konnektor can present any TLS certificate, such as self-signed, expired, or those with an incorrect Common Name CN, t...

CVE-2026-46367: Improper Neutralization of Input During Web Page Generation

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multilingual, database-driven FAQ system developed by Thorsten Rinne. Versions of phpMyFAQ prior to 4.1.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the Utils::parseUrl function, which allowed authenticated users to inject JavaScript through...

PT-2026-41374

Name of the Vulnerable Software and Affected Versions @angular/platform-server versions prior to 22.0.0-next.12 @angular/platform-server versions prior to 21.2.13 @angular/platform-server versions prior to 20.3.21 @angular/platform-server versions prior to 19.2.22 Description A Server-Side Reques...

PT-2026-41396

Impact An attacker who can MITM the TLS connection between the client and the IDP within the TI network can substitute a forged discovery document. The forged document redirects u ri puk idp enc and uri puk idp sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge...

PT-2026-41369

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...