24255 matches found
CVE-2026-31890 Inspektor Gadget: Tracing Denial of Service via Event Flooding
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is – incidentally or maliciously – already full, the gadget will silently drop events. Th...
CVE-2026-28356
creationtimestamp| type| source ---|---|--- 2026-03-12 17:31:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mguwj7ocuh2c 2026-03-12 20:09:48+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mgv7eod5rta2 2026-03-13 07:40:05+00:00| seen|...
CVE-2019-25536
creationtimestamp| type| source ---|---|--- 2026-03-12 17:26:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mguwblh6d72k 2026-04-07 02:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miuomhtccj2u...
CVE-2019-25537
Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with malicious SQL payloads in the Email...
CVE-2019-25537 Netartmedia Event Portal 2.0 SQL Injection via loginaction.php
Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with malicious SQL payloads in the Email...
CVE-2019-25537
Netartmedia Event Portal 2.0 is affected by a time-based blind SQL injection in the Email parameter of loginaction.php, exploitable without authentication. Attackers can send crafted POST requests to extract sensitive database information. The vulnerability enables attackers to manipulate queries...
CVE-2019-25537
Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with malicious SQL payloads in the Email...
CVE-2019-25537 Netartmedia Event Portal 2.0 SQL Injection via loginaction.php
Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with malicious SQL payloads in the Email...
CVE-2026-32112
creationtimestamp| type| source ---|---|--- 2026-03-12 14:40:06+00:00| seen| https://gist.github.com/alon710/ab92af6bf1518fd7ebffd80c72fb5bb0...
GHSA-V8CG-4474-49V8 OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers
Summary Slack member and message subtype system events messagechanged, messagedeleted, threadbroadcast were not consistently enforcing sender authorization before enqueueing system events. Affected Packages / Versions - Package: openclaw npm - Latest published version: 2026.2.25 - Affected range:...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the EventStream broadcasts execution. An attacker can access sensitive action output and execution metadata by subscribing to the event stream as a low-privileged authenticated user, thereby bypassing intended...
GHSA-228V-WC5R-J8M7 OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream
Summary OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control...
Cross-site Scripting (XSS)
Overview org.webjars.npm:unhead is a Full-stack manager built for any framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the acceptDataAttrs function, which allows attribute names containing spaces or illegal characters to be injected into SSR-rendered HTM...
GHSA-G5XX-PWRP-G3FV Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
Summary useHeadSafe can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. Details XSS via data- attribute name injection The acceptDataAttrs function safe.t...
CVE-2025-13690
creationtimestamp| type| source ---|---|--- 2026-03-12 14:15:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgull4qogo2n 2026-03-12 16:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260313...
CVE-2026-0602
creationtimestamp| type| source ---|---|--- 2026-03-12 14:15:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgull4qogo2n 2026-03-12 16:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260313...
Security Bulletin: Multiple Vulnerabilities in IBM Event Streams
Summary Multiple vulnerabilities were addressed in IBM Event Streams version 12.2.2 Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a...
GHSA-G3HP-VVQF-8VW6
creationtimestamp| type| source ---|---|--- 2026-03-12 09:40:06+00:00| seen| https://gist.github.com/alon710/49f2db569bc474aab9f493dc84839f32...
CVE-2026-28791
creationtimestamp| type| source ---|---|--- 2026-03-12 05:09:56+00:00| published-proof-of-concept| https://github.com/tinacms/tinacms/security/advisories/GHSA-5hxf-c7j4-279c 2026-03-12 19:40:05+00:00| seen| https://gist.github.com/alon710/d73d499cf1d6e8d3c3762966f6b93ea2...