257071 matches found
CVE-2026-88055 AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store metapagetitle or metapagefavicon through /api/admin/system-preferences, and MetaGenerator inserts those values into...
CVE-2026-68487
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
Security Bulletin: IBM MQ Appliance is affected by an improper authorization vulnerability (CVE-2026-10030)
Summary IBM MQ Appliance has addressed an improper authorization vulnerability that could allow an authenticated attacker to create and start queue managers. Vulnerability Details CVEID:CVE-2026-10030 DESCRIPTION: IBM MQ Console allows authenticated non-administrative users to create and start...
netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass
A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...
CVE-2026-68487
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
EUVD-2026-75596
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
CVE-2026-68487
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
CVE-2026-68487
CVE-2026-68487 is a path traversal vulnerability in Plesk's Backup Manager caused by an unsigned backup header , allowing an authenticated customer to perform an arbitrary file write as root . The vulnerability is scored CVSS 9.9 (Critical) with a changed scope, reflecting high impact on confiden...
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
Summary IBM Navigator for i and IBM Digital Certificate Manager DCM for i use Angular for frontend Graphical User Interfaces GUI. Angular is vulnerable to cross-site scripting XSS by permitting event-handler attributes in the i18n pipeline, allowing a lower-trust translation file to inject...
GO-2026-6371 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore...
Vulnerability fixed in Fortinet FortiOS
Fortinet has fixed a vulnerability in FortiOS FortiSASE and FortiSwitchManager specifically. The vulnerability is located in the cwacd daemon in FortiOS and FortiSwitchManager. This daemon is vulnerable to exploitation by remote, unauthenticated attackers. By sending specially crafted packets or...
CVE-2026-88885
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...
CVE-2026-88888
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...
Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to cert-manager ( CVE-2026-25518 )
Summary Potential vulnerabilities in cert-manager package CVE-2026-25518 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-25518 DESCRIPTION: cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and...
CVE-2026-88888
A flaw was found in Renovate. Attackers can exploit a command injection vulnerability in the Mix manager by injecting shell metacharacters through malicious package names when processing private dependencies with unescaped organization parameters. This allows for the execution of arbitrary comman...
CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...
CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...
CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...
CVE-2026-88888
Renovate before 44.14.7 is affected by a command injection vulnerability in the Mix manager . The root cause is unescaped organization parameters when processing private dependencies, allowing attackers to inject shell metacharacters through malicious package names. Successful exploitation enable...
EUVD-2026-75438
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...