33420 matches found
CVE-2026-18631 jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization
A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...
CVE-2026-66296 Reflected XSS in oaskit's default HTML error handler
Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...
CVE-2026-66296
The CVE-2026-66296 issue concerns oaskit: a reflected XSS vulnerability in the default HTML error handler. The root cause is that Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 render request-validation failures as HTML when the Accept header includes...
CVE-2026-66296
Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...
EEF-CVE-2026-66296 Reflected XSS in oaskit's default HTML error handler
Summary Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in...
Updated libvncserver packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Heap Out-of-Bounds Read in HandleUltraZipBPP due to unchecked subrectangle count. CVE-2026-32853 NULL pointer dereferences in httpd proxy handlers via malformed CONNECT/GET requests. CVE-2026-32854 LibVNCClient Tight Gradient decoding allows...
CVE-2026-61523
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...
DEBIAN-CVE-2026-68930
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, serverreadauthenticated, and the execrequest callback. Version 0.62.5 fixes the issue...
CVE-2026-18606
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...
CVE-2026-69151
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...
UBUNTU-CVE-2026-69151
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...
GHSA-JJ27-H5HQ-8X99 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...
CVE-2026-69151
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes is caused by the i18n pipeline allowing i18n-onerror and similar attributes to be translated, enabling a lower-trust translation file to replace a benign handler with executable JavaScript. Affected versions are prior to 20.3.2...
CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...
EUVD-2026-52369
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...
CVE-2026-18606
RCE-like local privilege escalation in Razer RzUpdateService 1.10.14.0 via Named Pipe Handler (RzUpdateService.exe). Manipulating lpThreadParameter is reported to cause improper privilege management; requires local access. Publicly available exploit noted; vendor contacted early. No remediation d...
EUVD-2026-52351
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...
CVE-2026-18606 Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...
CVE-2026-18606
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...