35 matches found
CVE-2026-103271
Ghost versions from 4.0.0 before 6.63.0 are vulnerable to a content API vulnerability that enables unauthenticated visitors to bypass content restrictions. Attackers can directly query the content API to retrieve gated post content without providing any authentication. No specific exploit details...
CVE-2026-103271: Incorrect Authorization
Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...
CentOS Linux 7 [TuxCare] Security Update: python-lxml / python-lxml-docs (CENTOS7:CLSA-2024:1729629058)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1729629058 advisory. - lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafte...
EUVD-2026-87258
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass the mixed content policy through a crafted HTML page. Chromium security severity: Low...
CVE-2026-78153 Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
CVE-2026-54570 AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing...
CVE-2026-64793: Improper Access Control
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to...
CVE-2026-44664 fast-xml-builder: Comment Value bypass regex
fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace/--/g, '- -'. This skip the values containing three consecutive dashes e.g., ---..., allowing an attacker to break out of an XML comment and...
EUVD-2026-25368
Kirby is an open-source content management system. Kirby's Xml::value method has special handling for blocks. If the input value is already valid CDATA, it is not escaped a second time but allowed to pass through. However, prior to versions 4.9.0 and 5.4.0, it was possible to trick this check int...
Linux Distros Unpatched Vulnerability : CVE-2026-35543
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content with animate attributes...
CVE-2026-34510 OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders
OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended...
CVE-2026-34510
OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets treated as local content, bypassing access restrictio...
EUVD-2021-10134
Malware in sbrugna...
EUVD-2015-0618
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2015-5826
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets CSS document is required to have the text/css content type,...
HTML sanitizer security vulnerability
HTML sanitizer is an allowlist-based HTML cleaner by Matthias Kestenholz, a personal developer. A security vulnerability exists in HTML sanitizer, which is caused by specially crafted HTML that can escape cleaning...
SUSE CVE-2024-3845
Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML page. Chromium security severity: Low...
PT-2024-3083 · Google +6 · Google Chrome +6
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 124.0.6367.60 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Networks component, allowing a remote attacker to bypass mixed content...