7050 matches found
CVE-2026-32534
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through = 3.0.3...
CVE-2026-32535
The provided Connected documents confirm CVE-2026-32535 affects the WordPress JS Help Desk plugin (versions ≤ 3.0.3). The vulnerability is an Insecure Direct Object References (IDOR) leading to an Authorization Bypass through a User-Controlled Key, caused by misconfigured access control security ...
CVE-2026-32535
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through = 3.0.3...
CVE-2026-32534
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through = 3.0.3...
CVE-2026-32534 WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through = 3.0.3...
CVE-2026-32534: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through = 3.0.3...
WordPress plugin JS Archive List 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. There is a...
CVE-2026-32513: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through = 6.1.7...
CVE-2026-32535: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through = 3.0.3...
@chainless-js/biometric-ed25519 (>=1.2.4, <=1.2.6), @forwardemail/wildduck (>=1.40.10, <=4.0.3) +17 more potentially affected by unknown CVE via fido2-lib (>=3.2.5, <=3.5.6)
fido2-lib NPM version =3.2.5, =1.2.4, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =6.6.6, =0.0.2, =0.0.1, =1.0.0-alpha.1, =1.2.3, =6.0.0, =5.8.30, =1.46.1, =1.46.25 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G3QJ-J598-CXMQ...
CVE-2026-33418
DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the "ensureSize" function in "@dicebear/converter" used a regex-based approach to rewrite SVG "width"/"height" attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed b...
io.undertow.js:undertow-js (>=1.0.0.alpha3, <=1.1.0.beta1), io.undertow.js:undertow-js-freemarker (1.1.0.beta1) +69 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (1.3.0.beta6)
io.undertow:undertow-core MAVEN version 1.3.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow.js:undertow-js =1.0.0.alpha3, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.beta1 ...
Parse Server 安全漏洞
Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.60 and 9.6.0-alpha.54. These vulnerabilities stemmed from the ability for MFA recovery...
PT-2026-27482
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.57 Parse Server versions prior to 9.6.0-alpha.48 Description An authenticated user can modify server-generated session fields, such as expiresAt and createdWith, when updating their own session through the RE...
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values e.g.,...
jsrsasign 安全漏洞
jsrsasign is a signature verification library developed by Kenji Urushima. Versions of jsrsasign prior to 11.1.1 contained security vulnerabilities. These vulnerabilities stemmed from numerical type conversion errors during the handling of negative exponents in the ext/jsbn2.js file, which could...
PT-2026-27058
Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.1.1 Description Incorrect Conversion between Numeric Types occurs due to the handling of negative exponents in the file ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break...
CVE-2026-4598: Loop with Unreachable Exit Condition
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values e.g.,...
CVE-2026-4602: Incorrect Conversion between Numeric Types
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative...
jsrsasign 安全漏洞
jsrsasign is a signature verification library developed by Kenji Urushima. Versions of jsrsasign prior to 11.1.1 contained security vulnerabilities. These vulnerabilities stemmed from the bnModInverse function in ext/jsbn2.js, which could cause infinite loops when processing zero or negative...