212070 matches found
DRUPAL-CONTRIB-2026-179
This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order...
SUSE CVE-2026-95276
Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. Chromium security severity: Medium...
SUSE CVE-2026-95364
Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
SUSE CVE-2026-95381
Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-95382
Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...
Security Bulletin: This Power System update is being released to address CVE-2026-17503
Summary Power Systems Firmware is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention —...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
vulnerabilities in Adobe Experience Manager Forms JEE
Adobe has identified 6 vulnerabilities in Adobe Experience Manager AEM Forms for Java Enterprise Edition JEE, including AEM 6.5 Forms and AEM 6.5 LTS Forms. These vulnerabilities concern various security issues, such as improper authorization, inadequate input validation, Server-Side Request...
CVE-2026-80444
URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...
CVE-2026-93337
A flaw was found in NetworkManager-l2tp. This improper input validation vulnerability allows local users with permissions to create VPN connections to inject arbitrary directives into the pppd Point-to-Point Protocol Daemon options file. By supplying specially crafted mru or mtu property values, ...
EUVD-2026-85259
URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...
CVE-2026-80444 Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS
URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...
CVE-2026-80444
Abis Technology Ltd. Co. AVESİS is vulnerable to an open redirect vulnerability caused by Input Data Manipulation . This flaw allows an attacker to redirect users to an untrusted site. The issue specifically affects versions from 202608201331 before 202608240351 . Exploitation details are not pro...
CVE-2026-80444 Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS
URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...
Cross-site Scripting (XSS)
Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper input neutralization in the XSSImpl process. An attacker...
CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...
CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into...
RLSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 fix Rocky Linux-11927...
libxml2 security, bug fix, and enhancement update
An update is available for libxml2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...