33379 matches found
CSRF vulnerability in jenkins-multijob-plugin allows arbitrary code execution
jenkins-multijob-plugin 669.v9d96ad9c71b0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...
PT-2026-68115
Name of the Vulnerable Software and Affected Versions 299Ko affected versions not specified Description An unauthenticated attacker can perform a reflected Cross-Site Scripting XSS attack via the public contact form. The issue occurs because the home function in...
MAL-2026-11522 Malicious code in beaver-ui-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...
django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-15830 via django (1.7.0)
django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
WordPress DTX – Dynamic Text Extension for Contact Form 7 plugin <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by SATYARTH PRAKASH XoxoL33t in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.5...
CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
Malicious code in @servicetitan/marketing-form (npm)
npm/@servicetitan/marketing-form is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
CLSA-2026-1785117456 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.0.0-tuxcare.2...
CLSA-2026-1785117393 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.2.0-tuxcare.2...
CLSA-2026-1784943288 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.1.4-tuxcare.2...
CLSA-2026-1784943225 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.3.3-tuxcare.5...
CLSA-2026-1785117379 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.0.8-tuxcare.2...
CLSA-2026-1784856461 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.0-tuxcare.2...
CLSA-2026-1785117388 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.1.4-tuxcare.2...
CLSA-2026-1785117455 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 1.0.1-tuxcare.2...
CLSA-2026-1784856187 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.1-tuxcare.2...
CLSA-2026-1781484836 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.0-tuxcare.1...
CLSA-2026-1781484855 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.1-tuxcare.1...