41336 matches found
EEF-CVE-2026-66353 Doggo vulnerable to cross-site scripting via unescaped date field values
Summary Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim",...
EUVD-2026-67094
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...
CVE-2026-59280 Spring Framework Path Traversal via Backslash in SpringTemplateLoader
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...
CVE-2026-59280
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...
CVE-2026-59280
Applications utilizing Spring Framework 's FreeMarker integration may be susceptible to a path traversal attack. The vulnerability occurs when a controller returns a view name derived from untrusted input while FreeMarker is configured to resolve templates via SpringTemplateLoader . A remote atta...
CVE-2026-59280 Spring Framework Path Traversal via Backslash in SpringTemplateLoader
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...
EUVD-2026-67081
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988
CVE-2026-79988 affects Craft CMS , where the Twig sandbox mechanism is misconfigured to allow dangerous functionality from the Yii framework , enabling authenticated remote code execution (RCE) . The vulnerability is rated CVSS 8.7 (HIGH) with a low complexity, network-based attack vector requiri...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-81672
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...
Security Bulletin: Multiple security vulnerabilities identified in Spring Framework version shipped with IBM Guardium Cryptography Manager (GCM)
Summary Security vulnerabilities identified in Spring Framework shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static...
EUVD-2026-67005
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...
CVE-2026-81672 Multiple Vulnerabilities in TOOOLS' iSquad
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...
CVE-2026-81672
CVE-2026-81672 is a SQL injection vulnerability in TOOOLS' iSquad , affecting the /ws/apiprensa/getVideoSubcanal endpoint. The root cause is improper handling of the id_video parameter: the application does not sanitize input before constructing SQL queries, leading to execution errors with malic...
CLSA-2026-1787823679 TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.39-tuxcare.20...
[SECURITY] [DSA 6473-1] libdbi-perl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6473-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 27, 2026 https://www.debian.org/security/faq -...
