EUVD-2026-9787

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting XSS vulnerability in the Event Types of the HumHub Calendar module impacts users...

CVE-2026-29052

HumHub Calendar module (HumHub) contains a Stored XSS in Event Types affecting versions prior to 1.8.11. The vulnerability can be triggered when viewing events created by an administrative account; no user interaction is required and attack vector is network. The issue is fixed in version 1.8.11....

CVE-2026-29052 HumHub Calendar Module: Stored XSS in Event Types

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting XSS vulnerability in the Event Types of the HumHub Calendar module impacts users...

CVE-2026-29052 HumHub Calendar Module: Stored XSS in Event Types

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting XSS vulnerability in the Event Types of the HumHub Calendar module impacts users...

CVE-2026-29052

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting XSS vulnerability in the Event Types of the HumHub Calendar module impacts users...

CVE-2026-29052 HumHub Calendar Module: Stored XSS in Event Types

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting XSS vulnerability in the Event Types of the HumHub Calendar module impacts users...

GHSA-RVPW-P7VW-WJ3M

creationtimestamp| type| source ---|---|--- 2026-03-05 03:10:05+00:00| seen| https://gist.github.com/alon710/a6851bbd56dcc5d9e2542a826139f558...

CVE-2026-29126 World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE

Incorrect permission assignment world-writable file in /etc/udhcpc/default.script in International Data Casting IDC SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges local privilege escalation and persistence via...

GHSA-5528-5VMV-3XC2

creationtimestamp| type| source ---|---|--- 2026-03-05 00:40:06+00:00| seen| https://gist.github.com/alon710/303814197fd47e8be1513f6dbe263ced...

PT-2026-23407

Name of the Vulnerable Software and Affected Versions HumHub Calendar module versions prior to 1.8.11 Description The Calendar module for HumHub allows users to create and manage events. A stored cross-site scripting XSS issue exists in the Event Types functionality of the Calendar module for...

Calendar 跨站脚本漏洞

Calendar is an event management module developed by HumHub, offering a comprehensive solution for events within companies or organizations. Versions of Calendar prior to 1.8.11 contained a cross-site scripting vulnerability. This vulnerability stemmed from the existence of storage-type cross-site...

DEBIAN-CVE-2026-2297

The import hook in CPython that handles legacy .pyc files SourcelessFileLoader is incorrectly handled in FileLoader a base class and so does not use io.opencode to read the .pyc files. sys.audit handlers for this audit event therefore do not fire...

AZL-79413 CVE-2026-2297 affecting package python3 3.9.19-19

The import hook in CPython that handles legacy .pyc files SourcelessFileLoader is incorrectly handled in FileLoader a base class and so does not use io.opencode to read the .pyc files. sys.audit handlers for this audit event therefore do not fire...

CVE-2026-30223

creationtimestamp| type| source ---|---|--- 2026-03-04 23:05:53+00:00| published-proof-of-concept| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9 2026-03-06 23:53:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggj3u4co52o 2026-03-07 09:06:05+00:00|...

CVE-2026-3542

creationtimestamp| type| source ---|---|--- 2026-03-04 19:52:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgb2noyjhl2e 2026-03-05 14:15:28+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgcycra7ak26 2026-03-09 00:00:00+00:00| seen|...

GHSA-P6XX-57QC-3WXR Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()

Summary When using streamSSE in Streaming Helper, the event, id, and retry fields were not validated for carriage return \r or newline \n characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if...

Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()

Summary When using streamSSE in Streaming Helper, the event, id, and retry fields were not validated for carriage return \r or newline \n characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if...

CVE-2026-2915

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16...

CVE-2026-27801

creationtimestamp| type| source ---|---|--- 2026-03-04 18:57:19+00:00| published-proof-of-concept| https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v6pg-v89r-w8wr 2026-03-04 23:53:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgbi64ynsm2v...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the processing of Slack interactive callbacks, specifically blockaction, viewsubmission, and viewclosed. An attacker can inject unauthorized system-event text...