59050 matches found
CVE-2026-35575 ChurchCRM has Stored XSS in Group Name
ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting Stored XSS vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator...
CVE-2026-39314 CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in ppdCreateFromIPP cups/ppd-cache.c allows any unprivileged local user to crash the cupsd root process by supplying a negative...
CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
CVE-2026-22683
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
EUVD-2026-19688
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...
EUVD-2026-19605
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 beta before 2.5.0b3 allows an attacker with dashboard creation privileges to perform stored cross-site scripting XSS attacks by tricking...
CVE-2026-4740
creationtimestamp| type| source ---|---|--- 2026-04-07 15:26:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3o7zjll2j 2026-04-07 17:29:14+00:00| published-proof-of-concept| Telegram/8eXn4QLj3W18AYc2pIsiDgfSWsuolTpz1YwE008yOgTXtw...
CVE-2026-3466
creationtimestamp| type| source ---|---|--- 2026-04-07 15:21:30+00:00| published-proof-of-concept| Telegram/OQovZCNyncHtmKsEQoVAn9WglYI3Qk-HPEu8DU-i8r2-BaQ 2026-04-07 15:38:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw4crqhwx2n...
CVE-2026-4401
creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4401 2026-04-08 00:08:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwytkwmbm2z 2026-04-20 15:37:06+00:00| seen|...
CVE-2026-5747
creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5747 2026-04-08 00:27:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwzuw7cz52z 2026-04-08 01:15:45+00:00|...
CERTFR-2026-ACT-015
creationtimestamp| type| source ---|---|--- 2026-04-07 14:41:37+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mivz5ulz6q2n 2026-04-12 02:57:19+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mjbe4yzibh2t...
CVE-2026-5378 runZero Platform user creation leak
An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N 5.8 Medium. This issue was fix...
CVE-2026-5378
The CVE-2026-5378 issue affects the runZero Platform. Affected component: user management functionality in the RunZero platform. Description indicates an Incorrect Authorization flaw that allowed administrators to create and update users outside of their authorized organization scope. Root cause ...
CVE-2026-5378 runZero Platform user creation leak
An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N 5.8 Medium. This issue was fix...
UBUNTU-CVE-2026-4292
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...
CVE-2026-3466
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 beta before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting XSS attacks by tricking a...
EUVD-2026-19598
Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...
CVE-2026-3466
CVE-2026-3466 affects Checkmk dashboards where dashlet title links are not properly sanitized, enabling stored XSS when a user with dashboard creation privileges creates a shared dashboard. Affected versions include Checkmk 2.2.0 (EOL), 2.3.0 before 2.3.0p46, 2.4.0 before 2.4.0p25, and 2.5.0 (bet...