17012 matches found
The vulnerability of Microsoft Visual Studio Code’s editor, related to errors in information processing, allows attackers to circumvent existing security restrictions.
The vulnerability of Microsoft Visual Studio Code’s source editor is related to errors in information processing. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...
Vvveb 跨站脚本漏洞
Vvveb is a powerful and easy-to-use CMS developed by Givan’s developers, used for building websites, blogs, or e-commerce stores. Versions of Vvveb prior to 1.0.8.3 had a cross-site scripting vulnerability, which stemmed from allowing permission upgrades through the post editor...
GHSA-5F64-7VFC-RCX6 Apostrophe has stored XSS via javascript: URL in Image Widget Link
Summary A stored cross-site scripting vulnerability was identified in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the liv...
Apostrophe has stored XSS via javascript: URL in Image Widget Link
Summary A stored cross-site scripting vulnerability was identified in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the liv...
RLSA-2026:16484 Important: gimp security update
The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP:Memo...
PT-2026-40885
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'register user' function, which only blocks the 'administrator'...
The vulnerability of the Rich Text Edit Control text editor in the Windows operating system, which allows attackers to exploit their privileges.
The vulnerability of the Rich Text Edit Control text editor in the Windows operating system is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to increase their privileges...
Security Bulletin: IBM i is Affected By A Cross-Site Scripting Vulnerability in Navigator for i [CVE-2026-0540]
Summary Navigator for IBM i uses the Monaco editor to edit config files. The Monaco editor uses DOMPurify to sanitize the HyperText Markup Language HTML in the editor. DOMPurify is vulnerable to improper neutralization of input by using rawtext elements missing from the SAFEFORXML regex...
EUVD-2026-30143
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege...
EUVD-2026-30137
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations...
EUVD-2026-30140
Any Editor could delete any snapshot, even if they have no access to read or write them...
[SECURITY] Fedora 42 Update: nano-8.3-4.fc42
GNU nano is a small and friendly text editor...
CVE-2026-45708
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...
CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...
CVE-2026-45708
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...
CVE-2026-45708
CubeCart before 6.7.3 is affected by an authenticated RCE via the Invoice Editor. An admin with documents edit permission can inject raw code, and when the next admin prints an order, the system writes the rendered template to files/print..php. The subsequent carve-out in files/.htaccess allows...
EUVD-2026-30175
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...
CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...
CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...