Lucene search
+L

61237 matches found

Tenable Nessus
Tenable Nessus
added 2026/03/05 12:00 a.m.5 views

MiracleLinux 9 : firefox-140.8.0-2.el9_7.ML.1 (AXSA:2026-241:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-241:03 advisory. libvpx: Heap buffer overflow in libvpx CVE-2026-2447 firefox: Invalid pointer in the JavaScript Engine component CVE-2026-2785 firefox: Memory safety...

10CVSS6.2AI score0.00604EPSS
SaveExploits3References39
Positive Technologies
Positive Technologies
added 2026/03/05 12:00 a.m.16 views

PT-2026-23603

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3 Description A malicious authenticated user can achieve stored cross-site scripting XSS by uploading SVG files and creating a hotlink for them. The hotlinking functionality does not properly handle scripts include...

8.7CVSS6AI score0.00189EPSS
SaveExploits0
CNNVD
CNNVD
added 2026/03/05 12:00 a.m.15 views

lxml_html_clean 安全漏洞

lxmlhtmlclean is a separate project derived from lxml.HTML.clean, open sourced by the Fedora Python SIG. Versions of lxmlhtmlclean prior to 0.4.4 contained security vulnerabilities. These vulnerabilities stemmed from the hassneakyjavascript method, which strips backslashes before checking for...

6.1CVSS5.8AI score0.00228EPSS
SaveExploits1References3
Tenable Nessus
Tenable Nessus
added 2026/03/05 12:00 a.m.6 views

Linux Distros Unpatched Vulnerability : CVE-2026-27601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the .flatten and .isEqual functions use recursion without a depth limit. Under very...

8.2CVSS5.3AI score0.00893EPSS
SaveExploits1References4
Tenable Nessus
Tenable Nessus
added 2026/03/05 12:00 a.m.24 views

AlmaLinux 9 : thunderbird (ALSA-2026:3516)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:3516 advisory. libvpx: Heap buffer overflow in libvpx CVE-2026-2447 firefox: Invalid pointer in the JavaScript Engine component CVE-2026-2785 firefox: Memory safety bugs...

10CVSS6.2AI score0.00604EPSS
SaveExploits3References40
OSV
OSV
added 2026/03/04 10:47 p.m.18 views

GHSA-PR34-2V5X-6QJQ ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint

Summary A vulnerability was discovered in Zitadel's login V2 interface that allowed a possible account takeover. Impact Zitadel exposes an HTTP endpoint named /saml-post. This endpoint is used for handling requests to SAML IdPs and accepts two HTTP GET parameters: url and id. When these parameter...

9.3CVSS6.5AI score0.00402EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/03/04 9:45 p.m.10 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getDynamicIcon endpoint when attacker-controlled input is embedded into SVG output without proper sanitization. An attacker can execute arbitrary JavaScript in the context of the web application by...

9.3CVSS7.3AI score0.00625EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/04 9:45 p.m.6 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getDynamicIcon endpoint when attacker-controlled input is embedded into SVG output without proper sanitization. An attacker can execute arbitrary JavaScript in the context of the web application by...

9.3CVSS7.3AI score0.00625EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/04 9:45 p.m.3 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getDynamicIcon endpoint when attacker-controlled input is embedded into SVG output without proper sanitization. An attacker can execute arbitrary JavaScript in the context of the web application by...

9.3CVSS7.3AI score0.00625EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/03/04 9:32 p.m.7 views

EUVD-2026-9491

Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

6AI score0.00289EPSS
SaveExploits0References3
OSV
OSV
added 2026/03/04 9:28 p.m.36 views

GHSA-WF6X-7X77-MVGW Immutable is vulnerable to Prototype Pollution

Impact What kind of vulnerability is it? Who is impacted? A Prototype Pollution is possible in immutable via the mergeDeep, mergeDeepWith, merge, Map.toJS, and Map.toObject APIs. Affected APIs | API | Notes | | --------------------------------------- |...

9.8CVSS5.9AI score0.00978EPSS
SaveExploits1References10
Github Security Blog
Github Security Blog
added 2026/03/04 8:19 p.m.26 views

locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection

Details A Remote Code Execution RCE flaw was discovered in the locutus project v2.0.39, specifically within the calluserfuncarray function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an...

8.1CVSS6.2AI score0.00776EPSS
SaveExploits1References6Affected Software1
OSV
OSV
added 2026/03/04 8:19 p.m.9 views

GHSA-FP25-P6MJ-QQG6 locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection

Details A Remote Code Execution RCE flaw was discovered in the locutus project v2.0.39, specifically within the calluserfuncarray function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an...

8.1CVSS6.2AI score0.00776EPSS
SaveExploits1References6
EUVD
EUVD
added 2026/03/04 6:31 p.m.9 views

EUVD-2026-9465

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the JSTokenize...

5.8CVSS6AI score0.00475EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/04 6:16 p.m.15 views

CVE-2026-20066

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the JSTokenize...

5.8CVSS0.00475EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/03/04 5:49 p.m.8 views

CVE-2026-20066

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the JSTokenize...

5.8CVSS6AI score0.00475EPSS
SaveExploits0References2Affected Software2
Vulnrichment
Vulnrichment
added 2026/03/04 5:49 p.m.7 views

CVE-2026-20066 Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the JSTokenize...

5.8CVSS6AI score0.00475EPSS
SaveExploits0References1
CVE
CVE
added 2026/03/04 5:49 p.m.22 views

CVE-2026-20066

CVE-2026-20066 affects multiple Cisco products using the Snort 3 Detection Engine. The issue stems from JSTokenizer normalization logic during HTTP inspection of JavaScript, allowing an unauthenticated remote attacker to trigger a DoS by causing the Snort 3 engine to restart, interrupting packet ...

5.8CVSS6AI score0.00475EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/03/04 5:15 p.m.40 views

CVE-2019-25502 Simple Job Script Cross-Site Scripting via job_type_value Parameter

Simple Job Script contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the jobtypevalue parameter in the jobs endpoint. Attackers can craft requests with SVG payload injection to execute arbitrary JavaScript in victim...

6.1CVSS0.00251EPSS
SaveExploits1References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/03/04 3:38 p.m.9 views

Security Bulletin: Cross-Site Scripting (XSS) Vulnerability in serialize-javascript Due to Improper Input Sanitization affects watsonx.data

Summary A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when...

5.4CVSS5.9AI score0.011EPSS
SaveExploits0Affected Software1
Rows per page
Query Builder