64858 matches found
CVE-2026-20310 Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...
EUVD-2026-53448
A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An...
CVE-2026-9195
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...
CVE-2026-15656
IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...
GHSA-7PGQ-CR25-XVC8
creationtimestamp| type| source ---|---|--- 2026-08-05 16:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364 2026-08-06 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364...
CVE-2026-9195
Progress MarkLogic Server Query Console is affected by a cross-site scripting (XSS) vulnerability in versions before 11.3.6 and 12.0.3. The issue allows a remote attacker to lure an authenticated administrator to a crafted URL, enabling arbitrary JavaScript execution in the administrator’s browse...
EUVD-2026-53397
Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...
CVE-2026-48911
CVE-2026-48911 describes an Insufficient Verification of Data Authenticity in Apache Answer (affected up to 2.0.1). The vulnerability arises from a missing authorization check in the external-login email binding flow, enabling unauthenticated attackers to take over arbitrary user accounts by guid...
CVE-2026-16442
CVE-2026-16442 affects Keycloak’s SAML broker component. The IdP-initiated SSO endpoint does not enforce whether a provider is restricted to account linking, enabling an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account...
CVE-2026-18933
creationtimestamp| type| source ---|---|--- 2026-08-05 14:33:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msdqom5zgp2c 2026-08-05 17:01:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117043971069363515 2026-08-06 11:39:41+00:00| seen|...
CVE-2026-61483
creationtimestamp| type| source ---|---|--- 2026-08-05 14:30:21+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/jhvy6kzsbsna4...
CVE-2026-12410
CVE-2026-12410 affects CCleaner on Windows, specifically the Uninstaller component prior to version 7.10.1464. The issue is a local privilege escalation where a symlink/junction created during uninstallation can be followed by CCleaner when deleting the application data folder, allowing an attack...
Malicious code in multi-reqs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...
tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...
CVE-2026-71248
creationtimestamp| type| source ---|---|--- 2026-08-05 11:34:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgn3sdny23 2026-08-05 12:37:13+00:00| seen| https://bsky.app/profile/cybercod.bsky.social/post/3msdk5vqh5r2y...
CVE-2026-70588
creationtimestamp| type| source ---|---|--- 2026-08-05 11:31:33+00:00| seen| https://gist.github.com/alon710/98861561e950349ba52fdd407f74f7c8...
CVE-2026-15452
creationtimestamp| type| source ---|---|--- 2026-08-05 10:30:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hpglrn2nlmpgf...
CVE-2026-7444
creationtimestamp| type| source ---|---|--- 2026-08-05 10:10:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/g2qu2owwxt7mn 2026-08-06 13:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msg4qorpbj2g...
CVE-2026-15452 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...