1253777 matches found
CVE-2026-81092
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...
CVE-2026-80210
FrontAccounting through 2.4.20 suffers from a Cross-Site Request Forgery (CSRF) flaw in its financial transaction forms. The application generates a CSRF token in end_form() (includes/ui/ui_controls.inc) and embeds it as the _token hidden field, but only admin/users.php and admin/change_current_u...
CVE-2026-80210 FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...
EUVD-2026-67144
FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...
CVE-2026-55553
A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. This can lead to the...
CVE-2026-11747 Reflected XSS in Seres Software's syWEB
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...
EUVD-2026-67134
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...
CVE-2026-11747
Seres Software syWEB is affected by a Reflected XSS vulnerability caused by improper neutralization of user-supplied input during web page generation. The flaw affects versions through 27082026 . An attacker who lures a user into a crafted link can execute script in the victim's context, with a c...
WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Theme Uncode versions = 2.12.7...
Security Bulletin: Security vulnerabilities have been identified in Golang version shipped with IBM Guardium Cryptography Manager (GCM)
Summary Security vulnerabilities identified in Golang version shipped with IBM Guardium Cryptography Manager GCM have been addressed. Vulnerability Details CVEID:CVE-2026-32283 DESCRIPTION: If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the...
portswigger---cross-site-scripting
portswigger-web-security-academy/ └── cross-site-scripting/...
WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.33...
cross-site-scripting
No d...
WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14.2...
EUVD-2026-67131
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...
CVE-2026-81819 Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81819
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81819
Flowintel versions >=3.3.0 expose the /my_assignment/user API endpoint with only general API authentication, lacking a role-specific restriction. The endpoint accepts a user_id parameter to return that user's task assignments, but previously allowed any authenticated user to query it. As a res...
CVE-2026-81668
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...
CVE-2026-5218
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...