24299 matches found
CVE-2020-13631
creationtimestamp| type| source ---|---|--- 2026-05-21 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03...
CVE-2020-13435
creationtimestamp| type| source ---|---|--- 2026-05-21 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03...
MAL-2026-4549 Malicious code in dot-utils-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3091b9bb8cbf714d9391a59f7303a3748e183bbdf0fba2264b7496a2072e717f On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable VITEDOTUTILSAESSECRET,...
Parser-Free Querying of Security Logs
Security analysts routinely query system logs to detect threats and investigate incidents, but each log source uses its own semi-structured format: logs are cheap to produce, but expensive to use. The standard approach, building per-source parsers to normalize logs into structured schemas, is...
Concrete CMS 跨站请求伪造漏洞
Concrete CMS is an open-source content management system developed by Concrete CMS. Versions prior to Concrete CMS 9.5.0 had a cross-site request forgeing vulnerability, which was exploited through the concrete/controllers/dialog/event/duplicate module...
Concrete CMS 安全漏洞
Concrete CMS is an open-source content management system designed for teams. Concrete CMS versions 9.5.0 and earlier have a security vulnerability that stems from an authorization bypass in the calendar event front-end dialog box. This vulnerability could lead to cross-calendar data leaks...
PT-2026-42570
Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.4.x Description Cross Site Request Forgery CSRF occurs at the 'concrete/controllers/dialog/event/duplicate' endpoint. CSRF is a flaw that allows an attacker to trick a victim into performing actions they d...
PT-2026-42545
Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.5.0 and earlier Description An authorization bypass exists in the Calendar Block. The function action get events fails to verify the canView permission on the calendar, which allows the disclosure of restricted event...
PT-2026-42544
Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a...
Concrete CMS 安全漏洞
Concrete CMS is an open-source content management system developed by Concrete CMS. Versions of Concrete CMS 9.5.0 and earlier have security vulnerabilities. These vulnerabilities stem from the fact that the actiongetevents function in the calendar block does not check the canView permissions of...
CVE-2026-24216
creationtimestamp| type| source ---|---|--- 2026-05-20 22:25:51+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmcx5mke7m2v...
CVE-2026-9123
creationtimestamp| type| source ---|---|--- 2026-05-20 22:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcvqccuii2n 2026-05-25 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260526 2026-05-26 18:00:00+00:00|...
CVE-2026-9136
A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update...
CVE-2026-31069
BillaBear all versions prior to Jan 2026 contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf without proper sanitization or identifier quoting. Although...
GHSA-GP95-J463-VV28
creationtimestamp| type| source ---|---|--- 2026-05-20 19:10:50+00:00| seen| https://gist.github.com/alon710/ab000f54d49f4216c2a377595eab5831...
EUVD-2026-31151
A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update...
GHSA-7VFX-9HWP-C2X4
creationtimestamp| type| source ---|---|--- 2026-05-20 15:46:13+00:00| seen| https://gist.github.com/steig/ddd6193b319e8b70af8f2659034a7922...
GHSA-HW27-4V2Q-5QFF Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *
Summary The SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a...
CVE-2026-3592
creationtimestamp| type| source ---|---|--- 2026-05-20 14:15:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3q4ymxu2m 2026-05-20 14:33:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmc4ra55ad24 2026-05-20 15:01:14+00:00| seen|...