GHSA-M56Q-VW4C-C2CP Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

When using in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected...

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

When using in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected...

CVE-2019-25411

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the GATEWAYGREEN parameter. Attackers can send POST requests to the DHCP configuration endpoint with script payloads to execute arbitrary JavaScript...

CVE-2019-25411 Comodo Dome Firewall 2.7.0 Cross-Site Scripting via DHCP

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the GATEWAYGREEN parameter. Attackers can send POST requests to the DHCP configuration endpoint with script payloads to execute arbitrary JavaScript...

CVE-2019-25411 Comodo Dome Firewall 2.7.0 Cross-Site Scripting via DHCP

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the GATEWAYGREEN parameter. Attackers can send POST requests to the DHCP configuration endpoint with script payloads to execute arbitrary JavaScript...

PT-2026-20924

Splunk Enterprise Windows flaws CVSS 7.7 CVE-2026-20143 & CVE-2026-20140 allow system takeover via DLL and Python search path hijacking. Patch immediately. Splunk CyberSecurity InfoSec WindowsSecurity DLLHijacking LPE PatchNow https://t.co/wudRkJ9tIM...

PT-2026-20923

Name of the Vulnerable Software and Affected Versions Splunk Enterprise for Windows versions prior to 10.2.0 Splunk Enterprise for Windows versions prior to 10.0.3 Splunk Enterprise for Windows versions prior to 9.4.8 Splunk Enterprise for Windows versions prior to 9.3.9 Splunk Enterprise for...

Comodo Dome Firewall cross-site scripting vulnerability

Comodo Dome Firewall is a unified threat management and next-generation firewall provided by the Chinese company Comodo. Version 2.7.0 of Comodo Dome Firewall contains a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of the GatewayGREEN parameter input in the...

Splunk Enterprise 9.2.0 < 9.2.12, 9.3.0 < 9.3.9, 9.4.0 < 9.4.8, 10.0.0 < 10.0.3 (SVD-2026-0205)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0205 advisory. - In Splunk Enterprise for Windows versions below 10.2.0, 10.0.3, 9.4.8, 9.3.9, and 9.2.12, a lowprivileged Windows user who ca...

GHSA-97F8-7CMV-76J2 Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER

Summary This is a scanning bypass to scanpytorch function in picklescan. As we can see in the implementation of getmagicnumber that uses pickletools.genopsdata to get the magicnumber with the condition opcode.name includes INT or LONG, but the PyTorch's implemtation simply uses picklemodule.load ...

Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER

Summary This is a scanning bypass to scanpytorch function in picklescan. As we can see in the implementation of getmagicnumber that uses pickletools.genopsdata to get the magicnumber with the condition opcode.name includes INT or LONG, but the PyTorch's implemtation simply uses picklemodule.load ...

Notepad++ Fixes Hijacked Update Mechanism Used to Deliver Targeted Malware

Notepad++ has released a security fix to plug gaps that were exploited by an advanced threat actor from China to hijack the software update mechanism to selectively deliver malware to targets of interest. The version 8.9.2 update incorporates what maintainer Don Ho calls a "double lock" design th...

Adobe After Effects Buffer Overflow

The vulnerability of Adobe After Effects video and dynamic image editing software relates to writing beyond the buffer memory boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Adobe After Effects Heap Buffer Overflow DoS

The vulnerability of Adobe After Effects video and dynamic image editing software relates to the use of the NULL pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

Adobe After Effects Integer Overflow RCE

The vulnerability of Adobe After Effects software for video and dynamic image editing is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-23533

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.1.5 through 2026.2.13 Description The OpenClaw Gateway does not adequately limit configured hook module paths before passing them to the import function, potentially allowing for code execution. An attacker with the...

PT-2026-50469

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 1.0.3 Description A scanning bypass exists in the scan pytorch function. The issue arises from a difference in how magic numbers are handled compared to PyTorch's implementation. While the software uses...

PT-2026-22452

Summary OpenClaw Gateway supports hook mappings with optional JavaScript/TypeScript transform modules. In affected versions, the gateway did not sufficiently constrain configured module paths before passing them to dynamic import. Under some configurations, a user who can modify gateway...

Siemens SINEC NMS Uncontrolled Search Command Execution

The vulnerability of the Siemens SINEC NMS network management system for monitoring industrial networks is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow a attacker to execute arbitrary code with administrator privileges using a specially craft...

GSSAPI Driver MongoDB Data Compromise

The vulnerability of the GSSAPI driver standard in the MongoDB Go Driver is related to buffer overflows in dynamic memory. Exploitation of this vulnerability could allow a malicious actor to compromise the integrity of protected information by reading one byte beyond the allocated dynamic memory...