41042 matches found
XmlNotepad code issue vulnerabilities
XmlNotepad is an open-source XML document browsing and editing tool developed by Microsoft. Versions of XmlNotepad prior to 2.9.0.21 had code vulnerabilities. These vulnerabilities stemmed from the default setting of enabling DTD processing, which could lead to the disclosure of local file conten...
CVE-2026-30277
An arbitrary file overwrite vulnerability in PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...
CVE-2026-30276
An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...
PT-2026-29274
Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 IBM ART versions 9.0 through 9.0.0.2 Tor Browser version 15.0.x Mullvad Browser affected versions not specified Firefox-hardened forks affected versions not specified Description IBM...
PT-2026-29283
Name of the Vulnerable Software and Affected Versions DeftPDF Document Translator version 54.0 Description A flaw exists in DeftPDF Document Translator v54.0 that allows attackers to overwrite critical internal files through the file import process. This can lead to arbitrary code execution or...
DeftPDF Document Translator has security vulnerabilities
DeftPDF Document Translator is an online tool developed by DeftPDF in the United States, which supports multilingual document translation and format conversion. Version 54.0 of DeftPDF Document Translator contains a security vulnerability. This vulnerability stems from an issue where arbitrary...
CVE-2025-10551: Improper Neutralization of Input During Web Page Generation
A Stored Cross-site Scripting XSS vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...
PT-2026-29341
Name of the Vulnerable Software and Affected Versions InvoiceShelf versions prior to 2.2.0 Description InvoiceShelf is a web and mobile application used for expense tracking, payments, invoice creation, and estimates. A Server-Side Request Forgery SSRF exists in the Estimate PDF generation module...
chromium -- security fixes
Chrome Releases reports: This update includes 21 security fixes: 493952652 High CVE-2026-5273: Use after free in CSS. Reported by Anonymous on 2026-03-18 491732188 High CVE-2026-5272: Heap buffer overflow in GPU. Reported by inspector-ambitious on 2026-03-11 488596746 High CVE-2026-5274: Integer...
CVE-2026-34558
CI4MS is a CodeIgniter 4-based CMS skeleton. Affected versions prior to 0.31.0.0 expose stored DOM-based XSS via the Methods Management functionality where attacker-controlled input is stored server-side and later rendered in admin interfaces and global navigation without proper encoding. The roo...
CVE-2026-27599 CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Mail Settings. Several configuration...
CVE-2026-27599 CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Mail Settings. Several configuration...
Safeguarding LLMs against Misuse and AI-Driven Malware Using Steganographic Canaries
AI-powered malware increasingly exploits cloud-hosted generative-AI services and large language models LLMs as analysis engines for reconnaissance and code generation. Simultaneously, enterprise uploads expose sensitive documents to third-party AI vendors. Both threats converge at the AI service...
SUSE CVE-2026-33669
SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue...
Security update for poppler (moderate)
openSUSE security update: security update for poppler ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20397-1 Rating: moderate References: bsc1252337 Cross-References: CVE-2025-11896 CVSS scores: CVE-2025-11896 SUSE : 3.3...
LocalGPT code issue vulnerabilities
LocalGPT is a localized private document-based intelligent question-and-answer and analysis platform developed by PromptEngineer. LocalGPT has code issues and vulnerabilities; these vulnerabilities stem from incorrect operations on the doPOST function, resulting in unlimited uploads...
websec-payloads
Web Security Payloads & Exploitation Reference Comprehensiv...
CVE-2026-33669
SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue...
GHSA-27QH-8CXX-2CR5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
Summary This notification is related to the CloudFront signing utilities in the AWS SDK for PHP, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and...