61610 matches found
CVE-2026-32117 grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)
The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...
CVE-2026-32109
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...
PYSEC-2026-32
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...
CVE-2025-66956
Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL...
CVE-2026-32111
ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network...
CVE-2026-32109 Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...
CVE-2026-32109 Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...
CVE-2026-32109
Copyparty (portable file server) contains a vulnerability where an attacker with both read and write permissions can upload a file named .prologue.html and craft a link to potentially execute arbitrary JavaScript in a victim’s context. The attack requires the target to click the crafted link; nor...
CVE-2026-32109
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...
GHSA-9JFH-9XRQ-4VWM
creationtimestamp| type| source ---|---|--- 2026-03-11 20:10:06+00:00| seen| https://gist.github.com/alon710/42f2baf7f8222d8e21a959d90dfc0bba...
CVE-2026-31959
CVE-2026-31959 (Quill) : Quill before v0.7.1 is vulnerable to SSRF in the notarization logs retrieval flow. The client fetches a URL provided by the Apple notarization service and currently does not validate that the URL uses https or that the host is safe (not local or multicast). An attacker wh...
CVE-2026-31959 SSRF in Quill via unvalidated URL from Apple notarization log retrieval
Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forgery SSRF vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple'...
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Summary An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. Details Data Exposure Depending on the order payload configuration, attackers may retrieve: -...
GHSA-7VVP-J573-5584 Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Summary An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. Details Data Exposure Depending on the order payload configuration, attackers may retrieve: -...
CVE-2026-3950
creationtimestamp| type| source ---|---|--- 2026-03-11 19:16:22+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3950...
CVE-2026-31894
WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob and filegetcontents to read SQL files from the extracted contents. Neither the extraction nor the file reading...
CVE-2026-31894 WeGIA affected by arbitrary file read via symlink in backup restore
WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob and filegetcontents to read SQL files from the extracted contents. Neither the extraction nor the file reading...
CVE-2026-31863
creationtimestamp| type| source ---|---|--- 2026-03-11 18:10:06+00:00| seen| https://gist.github.com/alon710/2f5ac9f201724311bd0bb59616acb73c...
CVE-2026-31859
CVE-2026-31859 (Craft CMS) : Craft CMS is vulnerable to a reflective XSS via incomplete return URL sanitization. The fix for CVE-2025-35939 added a strip_tags() call in src/web/User.php to sanitize return URLs, but strip_tags() only strips HTML tags and does not validate URL schemes. Payloads suc...
CVE-2026-32246
creationtimestamp| type| source ---|---|--- 2026-03-11 17:36:15+00:00| published-proof-of-concept| https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39 2026-03-12 19:21:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgv4nkxbzb2t 2026-03-12...