66740 matches found
CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...
CVE-2026-59538
creationtimestamp| type| source ---|---|--- 2026-07-27 16:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbudcvfy2u 2026-08-12 12:16:25+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msv4b7hthz2w...
GHSA-93WV-JW9V-4972
creationtimestamp| type| source ---|---|--- 2026-07-27 16:00:06+00:00| seen| https://t.me/bdufstecru/3345 2026-07-28 00:00:32+00:00| published-proof-of-concept| https://t.me/bdufstecru/3345...
CVE-2026-41579
A flaw was found in runc, a tool used to run containers. A malicious container image, crafted with a specific type of symbolic link in its /dev directory, can deceive runc. This deception could lead to the deletion of certain files or the creation of predefined symbolic links on the host system...
CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
EUVD-2026-49328
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66395
SiYuan Desktop before v3.7.2 is affected by a reflected XSS in the bazaar plugin readme handler that enables RCE via a crafted siyuan:// deep link. An attacker can inject HTML payloads through the plugin name parameter, which render with insertAdjacentHTML in an insecure Electron renderer and gra...
CVE-2026-13332
creationtimestamp| type| source ---|---|--- 2026-07-27 15:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn66bnwxn2u...
CVE-2026-12495
creationtimestamp| type| source ---|---|--- 2026-07-27 14:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn2sy6nmo2y 2026-07-28 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mrpd7oaini2g 2026-08-13 11:20:18+00:00| seen|...
GHSA-6PQ5-P7FC-7XHQ
creationtimestamp| type| source ---|---|--- 2026-07-27 11:51:46+00:00| seen| https://gist.github.com/Correctover/e98078382935c28832271fc5a8e21606...
CVE-2026-64515
A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability arises from incorrect handling of Multi-Link Element MLE defragmentation. When a reconf or EPCS Enhanced Power Save MLE is present in a non-transmitted profile, the defragmentation routine uses an incorrect pointe...
CVE-2026-52686
creationtimestamp| type| source ---|---|--- 2026-07-27 06:55:48+00:00| seen| https://bsky.app/profile/shiojiri.com/post/3mrmcuzglnkeh...
CVE-2026-64459
creationtimestamp| type| source ---|---|--- 2026-07-27 06:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmb4icitc2y 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc...
CVE-2026-64410
creationtimestamp| type| source ---|---|--- 2026-07-27 06:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmayuss522y 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc...
CVE-2026-64355
creationtimestamp| type| source ---|---|--- 2026-07-27 06:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmadft45t2v 2026-08-06 04:49:57+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-15 12:46:43+00:00|...
CVE-2026-64303
creationtimestamp| type| source ---|---|--- 2026-07-27 06:06:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrma4cnjmz2k 2026-08-06 04:48:38+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-15 12:46:43+00:00|...
CVE-2026-64232
creationtimestamp| type| source ---|---|--- 2026-07-27 06:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrm7v56nxb2k...
CVE-2026-14827 Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...
