58853 matches found
PT-2026-29860
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the...
PT-2026-29733
A vulnerability was found in SourceCodester/mayuri k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access...
PT-2026-29931
Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor...
SourceCodester Leave Application System 安全漏洞
SourceCodester Leave Application System is an open-source vacation application system developed by SourceCodester. Version 1.0 of the SourceCodester Leave Application System contains a security vulnerability. This vulnerability stems from improper handling of the parameter ID in the...
PT-2026-29866
Name of the Vulnerable Software and Affected Versions Newgen OmniDocs versions up to 12.0.00 Description A security flaw exists in Newgen OmniDocs up to version 12.0.00. The issue involves improper control of resource identifiers due to manipulation of the DocumentId argument within the...
Newgen OmniDocs 安全漏洞
Newgen OmniDocs is an enterprise content management suite provided by Newgen Corporation. Versions of Newgen OmniDocs 12.0.00 and earlier contain security vulnerabilities. These vulnerabilities stem from incorrect handling of the DocumentId parameter in files/omnidocs/WebApiRequestRedirection,...
GHSA-FHRF-Q333-82FM
creationtimestamp| type| source ---|---|--- 2026-04-01 23:28:03+00:00| seen| Telegram/9GieXm2mvI1hTc72mHyuKx2RXs9Lk1GMse1mK9qILNsF30...
GHSA-458R-H248-29C5
creationtimestamp| type| source ---|---|--- 2026-04-01 23:27:52+00:00| seen| Telegram/coMrEhctUArWfU1Esx58b8AZjuGB2Ws5YwoScTDx0IuKI...
GHSA-R4V5-RWR2-Q7R4
creationtimestamp| type| source ---|---|--- 2026-04-01 23:27:43+00:00| seen| Telegram/9bl7FEfQKeFpZFPlYLUaNlRChLBL7dB3Syrn3BTLiX1da84...
GHSA-9CQ8-3V94-434G PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`
Summary The getalluserthreads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via updatethread. When the application loads the thread list, the injected payload executes and grants full database...
CVE-2025-58669
creationtimestamp| type| source ---|---|--- 2026-04-01 22:28:06+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mihqgjumqp2c...
CVE-2026-5313 Nothings stb GIF Decoder stb_image.h stbi__gif_load_next denial of service
A vulnerability has been found in Nothings stb up to 2.30. This issue affects the function stbigifloadnext in the library stbimage.h of the component GIF Decoder. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and ma...
CVE-2026-4820
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...
CVE-2026-34397
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose...
CVE-2026-20155
creationtimestamp| type| source ---|---|--- 2026-04-01 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0388/ 2026-04-01 17:32:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mih7vrdude2s 2026-04-01 18:30:56+00:00| seen|...
CVE-2026-0932
creationtimestamp| type| source ---|---|--- 2026-04-01 11:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migmbub6z625 2026-04-02 19:26:18+00:00| seen| Telegram/zX6Kqs44rDek2r3jgp5vCS4jdZwe09icUbxsylGXOdI3O8...
CVE-2026-30520
A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file specifically the saveloan action. The application fails to properly sanitize user input supplied to the "borrowerid" parameter in a POST request, allowing an...
CVE-2026-5157
A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected is an unknown function of the file /form/order.php of the component Order Module. Such manipulation of the argument custid leads to cross site scripting. The attack may be performed from remote. The exploit ...