CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

EUVD-2026-68399

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865

pdfme schemas versions prior to 5.5.10 are affected by a cross-site scripting (XSS) vulnerability in the multiVariableText property panel . The root cause is the assignment of unsanitized i18n label values to innerHTML , allowing an attacker who controls label overrides via options.labels to inje...

probo

Probo منصة حوكمة ومخاطر وامتثال GRC مفتوحة المصدر للمهندسين. Probo هي منصة حوكمة ومخاطر وامتثال GRC قابلة للاستضافة الذاتية، صُممت لفرق الهندسة والأمن. تغطي دورة حياة GRC بأكملها: تحديد المخاطر، تتبع الضوابط، مخاطر البائعين، خصوصية البيانات، مراجعات الوصول، برامج التدقيق، وسير عمل الموافقة على...

BIT-TOMCAT-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0...

CVE-2026-72818

A flaw was found in NLTK. The TweetTokenizer component, used for processing social media text, contains a regular expression vulnerability. A remote unauthenticated attacker can provide specially crafted input containing many alternating label separators, causing the regular expression to backtra...

K000163143: Multiple CoreDNS vulnerabilities CVE-2026-35579, CVE-2026-33489, CVE-2026-33190, CVE-2026-32934, CVE-2026-32936

Security Advisory Description CVE-2026-35579 CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configurati...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

Laravel-Security

Laravel Security تم إنشاء Laravel Security بواسطة Graham Campbell، ويتم صيانته بواسطته، وهو غلاف voku/anti-xss لـ Laravel، باستخدام graham-campbell/security-core. لا تتردد في الاطلاع على سجل التغييرات، والإصدارات، وسياسة الأمان، والترخيص، ومدونة قواعد السلوك، وإرشادات المساهمة. التثبيت يتطلب هذا...

HTB-Reactor-Linux-Machine-Walkthrough

HTB: Reactor !CAUTION تحذير من حرق الأحداث. هذا شرح كامل يتضمن الأعلام flags. إذا كنت تريد حل الجهاز بنفسك، أغلق هذا الآن وعد عندما تتعثر. معلومات الجهاز الحقل| التفاصيل ---|--- الاسم| Reactor نظام التشغيل| Ubuntu 24.04 LTS Noble الصعوبة| Medium CVE| CVE-2025-55182 CVSS 10.0 المنافذ| 22 SSH, 3000...

CVE-2021-28378

CVE-2021-28378 इस CVE के बारे में विवरण यहाँ देखें। यह CVE सर्वर से प्राप्त सामग्री पर क्लाइंट-साइड पर स्ट्रिंग एस्केपिंग की कमी को लक्षित करता है। यह एक हमलावर को किसी issue या pull request पर टिप्पणी बनाकर आसानी से मनमाना कोड इंजेक्ट करने में सक्षम बनाता है। यह कमिट...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses httpclient5-5.6.2.jar, aiohttp-3.13.4-cp311-cp311-manylinux2014x8664.manylinux217x8664.manylinux228x8664.whl, ip-address-10.2.0.tgz, datasets-3.6.0-py3-none-any.whl, jackson-databind-2.21.4.jar, keras-3.13.2-py3-none-any.whl, log4j-api-2.24.3.jar,...

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

tcpreplay v4.6.1

Tcpreplay Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Windows under Cygwin for editing and replaying network traffic previously captured by tools like tcpdump and Wireshark. It classifies traffic as client or server, rewrites Layer 2/3/4 headers, and replays it back onto the...

Apache Tomcat - Open Redirect

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Progress Kemp LoadMaster - Command Injection

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. id: CVE-2024-1212 info: name: Progress Kemp LoadMaster - Command Injection author: DhiyaneshDK severity: critical description: | Unauthenticated remote...

Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion

Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests. id: CVE-2017-1000028 info: name: Oracle GlassFish Server Open Source Edition 4.1 - Loc...