CVE-2026-8833 XSS in urls

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

USN-8395-1 netatalk vulnerabilities

Arjun Basnet discovered that Netatalk incorrectly sanitized user input in its MySQL CNID backend. A remote authenticated attacker could possibly use this issue to conduct SQL injection attacks. CVE-2026-44047 Arjun Basnet discovered that Netatalk incorrectly handled UCS-2 character set conversion...

BIT-PYTHON-MIN-2026-7774 tarfile.data_filter path traversal bypass allows writing outside the extraction directory

tarfile.datafilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall to write files outside the...

BIT-LIBPYTHON-2026-7774 tarfile.data_filter path traversal bypass allows writing outside the extraction directory

tarfile.datafilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall to write files outside the...

CVE-2026-11489

creationtimestamp| type| source ---|---|--- 2026-06-08 06:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnqyx67zan2p 2026-06-08 06:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116712959372246973 2026-06-08 07:37:17+00:00| seen|...

CVE-2026-11482

creationtimestamp| type| source ---|---|--- 2026-06-08 04:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnqtw6eeav22 2026-06-08 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116712605338377972 2026-06-08 07:17:44+00:00| seen|...

CVE-2026-11462

creationtimestamp| type| source ---|---|--- 2026-06-08 01:01:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqiasnxag27 2026-06-08 02:55:00+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mnqolijknr2b...

CVE-2026-11463

creationtimestamp| type| source ---|---|--- 2026-06-08 00:52:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqhq6jxpo27 2026-06-08 02:56:24+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mnqoneaqej2l...

The vulnerability of the IntelliJ IDEA integrated development environment lies in the improper definition of symbolic links during file access, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the IntelliJ IDEA integrated development environment is related to the incorrect definition of symbolic links during file access. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-47287

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

The vulnerability of the Zimbra Collaboration Suite’s email management system, related to incorrect restrictions on XML links to external objects, allows attackers to carry out XXE attacks.

The vulnerability of the Zimbra Collaboration Suite email management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

CVE-2026-11453

creationtimestamp| type| source ---|---|--- 2026-06-07 04:30:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnodh6oluy2a 2026-06-07 04:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116706942877312373...

CVE-2026-5415

The WP Captcha PRO the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajaxruntool AJAX handler relying solely on a nonce check...

CVE-2026-48921

A flaw was found in the Jenkins Pipeline: Groovy Libraries Plugin. This vulnerability allows an attacker, who can control the content of a library used by a Pipeline job, to read arbitrary files from the Jenkins controller filesystem. This could lead to the disclosure of sensitive information...

CVE-2026-7890

In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with a vector...

CVE-2026-36748

RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting XSS via Social Media links in user profile...

CVE-2026-44658

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and...

CVE-2026-30895

Lack of output escaping leads to a XSS vector in the readmore links for comcontent...

CVE-2026-47782

Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor...

CVE-2026-41063

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's ParsedownSafeWithLinks class overrides inlineMarkup for raw HTML but does not override inlineLink or inlineUrlTag, allowing javascript: URLs in markdown link syntax to bypass sanitization...