23471 matches found
CVE-2026-12382
The CVE-2026-12382 issue affects the AAP Gateway Envoy proxy. The non-mTLS route to EDA event streams fails to remove the Subject header despite requestHeadersToRemove, allowing an unauthenticated attacker to spoof a Subject header that matches a legitimate client certificate DN and bypass mTLS t...
CVE-2026-12382
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...
CVE-2026-54560
creationtimestamp| type| source ---|---|--- 2026-07-15 16:41:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp5yw2ad72s...
CVE-2026-61836
creationtimestamp| type| source ---|---|--- 2026-07-15 16:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqp3r2rc6t2i 2026-07-21 09:13:06+00:00| seen| https://bsky.app/profile/suriq.io/post/3mr5hr26efm2q...
CVE-2025-62826
creationtimestamp| type| source ---|---|--- 2026-07-15 14:20:28+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqow55nlat2n...
CVE-2026-59235
creationtimestamp| type| source ---|---|--- 2026-07-15 13:50:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqouh5o35a2a...
CVE-2026-44021
creationtimestamp| type| source ---|---|--- 2026-07-15 10:30:04+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3mqojbaj2up2b...
CVE-2026-49459
A flaw was found in DOMPurify, a library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. A remote attacker could exploit a vulnerability in the DOMPurify.sanitize function when used with the INPLACE: true option. This flaw allows an attacker to bypass the...
Exploit for CVE-2025-60357
CVE-2025-60357- NoSQLMongoDB Injection Vulnerab...
CVE-2026-13230
creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnswetk7c2a...
CVE-2026-48254
creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:15+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswdihda2t...
CVE-2026-13585
creationtimestamp| type| source ---|---|--- 2026-07-15 03:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnsjokhz42c 2026-07-15 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-16 06:28:08+00:00| seen|...
CVE-2026-15751
creationtimestamp| type| source ---|---|--- 2026-07-15 00:20:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnh6iiwsk2l...
GHSA-MQXV-9RM6-W8QC
creationtimestamp| type| source ---|---|--- 2026-07-14 22:13:10+00:00| seen| https://gist.github.com/alon710/c304e0355d4b523094aabb49f860b83c...
DEBIAN-CVE-2026-49459
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...
CVE-2026-49459
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...
GHSA-Q3V2-XJ35-9GRX
creationtimestamp| type| source ---|---|--- 2026-07-14 20:12:07+00:00| seen| https://gist.github.com/alon710/57f8fdc68fb17b420e33683532c115ad...
CVE-2026-49459 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...
CVE-2026-49459
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...