CVE-2026-95360

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-2586

Inyección EL Autenticada en GlassFish RCE CVE-2026-2586 Una vulnerabilidad de Inyección de Lenguaje de Expresiones en la Consola de Administración de GlassFish permite a un usuario autenticado inyectar expresiones EL maliciosas en los parámetros procesados por la interfaz web administrativa. Una...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95360): chromium -- security fixes

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-101018

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...

CVE-2026-101018 dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...

CVE-2026-101018 dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...

CVE-2026-101018

The dayrui XunruiCMS software, version up to 4.7.2 , contains a SQL injection vulnerability within the Group Editing component. The flaw exists in the group_all_edit function of the file dayrui/App/Member/Controllers/Admin/Home.php , where insufficient sanitization of the groupid argument allows ...

EUVD-2026-88203

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...

CVE-2026-101018: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...

CVE-2020-29254

CVE-2020-29254 TikiWiki 21.2 允许在未使用 CSRF 防护的情况下编辑模板。 ========================== 跨站请求伪造 CSRF： TikiWiki 21.2 允许在未使用 CSRF 防护的情况下编辑模板。这可能导致未经验证的远程攻击者实施跨站请求伪造 CSRF 攻击，并在受影响系统上执行任意操作。该漏洞源于受影响系统的基于 Web 的管理界面缺乏足够的 CSRF 防护。攻击者可利用此漏洞诱使用户访问恶意构造的...

CVE-2024-42758

CVE-2024-42758 indexmenu 插件在 Dokuwiki（开源 Wiki 引擎）中启用并使用的情况下，其 v2024-01-05 版本存在跨站脚本（XSS）漏洞。恶意攻击者可以在创建或编辑现有页面时输入 XSS 载荷，从而触发 Dokuwiki 上的 XSS，该载荷会存储在 .txt 文件中（由于 Dokuwiki 的设计特性），表现为存储型 XSS。 https://vulners.com/cve/CVE-2024-42758 受影响的 Dokuwiki 页面：doku.php?id=pagename 易受攻击的载荷： 由 Antun Matija Kriskovic...

CVE-2026-93643

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...

EUVD-2026-87101

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...

FeatMark: Feature-Level Watermark Protection against Mimicry Attacks with Diffusion Models

Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies sho...

CVE-2026-93643: Improper Limitation of a Pathname to a Restricted Directory

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...

Linux Distros Unpatched Vulnerability : CVE-2026-95360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...

PT-2026-97516

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description Broken Access Control ACL Bypass exists in the ApiController record editing functionality. The allowEdit function in ApiController.php contains a hardcoded return value of true, which bypasse...

CVE-2026-93975 code-projects Assessment Management User Editing edit-user.php cross site scripting

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

CVE-2026-93975 code-projects Assessment Management User Editing edit-user.php cross site scripting

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...