19669 matches found
CVE-2026-18111
Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...
CVE-2026-44282
Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The questiontitle helper returns the translatable question body through...
CVE-2026-44282 Election question titles allow stored script execution
Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The questiontitle helper returns the translatable question body through...
UBUNTU-CVE-2026-92059
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
DEBIAN-CVE-2026-92059
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92059
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92059
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
EUVD-2026-78522
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...
CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92059
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92059
The DOM: Editor component in Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to incorrect boundary conditions . This security issue has been addressed in versions Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the vulnerability is listed ...
CVE-2026-92059
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
grafana: Grafana: Privilege escalation via dashboard overwrite
A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...
grafana: Grafana: Privilege escalation via dashboard overwrite
A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...
CLSA-2026-1789465375 TuxCare security update for launch-editor (2 CVEs)
TuxCare rebuilt launch-editor to address 2 CVEs. Fixed in 2.2.1-tuxcare.1...
CVE-2026-16593 WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...
CVE-2026-16593 WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...
WordPress WP Directory Kit plugin <= 1.5.7 - Editor+ SQL Injection vulnerability
Editor+ SQL Injection vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions = 1.5.7...
