CVE-2026-10729 HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting XSS in emails clients that render HTML emails. This issue affects Canarytokens: fr...

SUSE CVE-2026-38978

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths...

PT-2026-60336

Уязвимость программного обеспечения для управления пользователями беспроводных сетей NETAMS WNAM связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, перехватить сессию и захватить учетную запись другого пользовател...

Canarytokens security vulnerability

Canarytokens is a network activity tracking system open-source by Thinkst Applied Research. There is a security vulnerability in Canarytokens, which stems from HTML injection in notification emails. This vulnerability may lead to interface manipulation and cross-site scripting attacks...

PT-2026-54586

Уязвимость веб-интерфейса программного обеспечения веб-конференцсвязи Cisco Webex Meetings связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, проводить межсайтовые сценарные атаки XSS...

CVE-2026-38978

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths...

CVE-2026-36608: Unintended Proxy or Intermediary

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP 192.168.1.1 or localhost 127.0.0.1 as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the intern...

PT-2026-45936

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting XSS in emails clients that render HTML emails. This issue affects Canarytokens: fr...

CVE-2026-36608

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP 192.168.1.1 or localhost 127.0.0.1 as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the intern...

PT-2026-60334

Уязвимость программного обеспечения для управления пользователями беспроводных сетей NETAMS WNAM связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к веб-интерфейсу системы с...

CVE-2026-10729: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting XSS in emails clients that render HTML emails. This issue affects Canarytokens: fr...

CVE-2026-20233: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed. This vulnerability...

CVE-2026-39107: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches to the 'Preview' tab to view AI-generated code, the malicious payload is...

CVE-2026-42840: Improper Neutralization of Input During Web Page Generation

An authenticated user can persist arbitrary HTML/JavaScript in the emailid or mobileno fields of a Customer record and trigger unescaped rendering in the Point of Sale POS interface for every operator who selects that customer. This issue affects ERPNext: 16.16.0...

Rack Modular Interface DoS

The vulnerability of the Ruby-based Rack web server’s modular interface is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Rack map_accel_path Unauthorized Access

The vulnerability of the mapaccelpath method in the Ruby programming language-based Rack web server module interface is related to the use of a regular expression, which does not sufficiently restrict the set of allowed values. Exploiting this vulnerability can allow an attacker to gain...

Rack Modular Interface Bypass

The vulnerability of the Ruby-based Rack web server’s modular interface is related to the occurrence of interpretation conflicts when processing HTTP headers’ names and values. Exploiting this vulnerability allows a remote attacker to bypass security restrictions...

Rack Modular Interface Bypass

The vulnerability of the Ruby-based Rack web server’s modular interface is related to improper behavior. Exploiting this vulnerability allows a remote attacker to bypass existing security mechanisms...

Rack Modular Interface Buffer Overflow

The vulnerability of the Ruby-based Rack web server’s modular interface is related to improper handling of parameter length discrepancies. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the protected information...

Rack Unauthenticated Access

The vulnerability of the Ruby-based Rack web server’s modular interface is related to partial comparison. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...