1149156 matches found
PT-2026-71229
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...
CVE-2026-73326: Missing Authorization
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...
CVE-2026-19217: Improper Neutralization of Input During Web Page Generation
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
GitLab 18.2 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-15217)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site...
PT-2026-71176
XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
WordPress AI Engine Cross-Site Script Vulnerability
WordPress AI Engine is an official WordPress plugin developed by developer JordyMeow. It aims to seamlessly integrate mainstream large language models such as OpenAI, Anthropic, and Google into the WordPress backend, providing core features like chatbots, content generation, AI forms, and...
ROS-20260812-73-0031
The vulnerability in Jenkins is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...
PT-2026-71214
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where improper neutralization of user-controlled data rendered in pagination controls by ...
Debian dla-4736 : python-django-doc - security update
The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4736 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected]...
GitLab 18.2 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-15216)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
EUVD-2026-56939
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-66146
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in SonicWall GMS version 9.5.1 (Build 9510.1044) and earlier versions. These flaws, categorized under CWE-79 , allow a remote attacker to execute malicious JavaScript in a user's browser. While the risk level is moderate, the ven...
MINI-JJWX-F4GC-H8RP
Bulletin has no description...
Security Bulletin: IBM Watsonx BI Assistant for CP4D affected by multiple CVEs
Summary Multiple CVE's were addressed in IBM Watsonx BI Assistant for CP4D version 5.4 patch 4 Vulnerability Details CVEID:CVE-2026-44665 DESCRIPTION: fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it...
CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...
CVE-2026-71386
is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...