14064 matches found
CVE-2026-64821 djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views
djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...
CVE-2026-16441
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-59140
The Data::SortedSet::Shared Perl module (versions before 0.03 ) is vulnerable to an out-of-bounds read . The issue stems from the ss_validate_header validator only checking the root index against the node pool capacity, while the rank , min , and max query paths read children[], leftmost, and rig...
CVE-2026-16439
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
CVE-2026-16441
Eclipse OpenJ9 up to version 0.60 has a method resolution flaw (CWE-758): when a previously concrete superclass method is recompiled as abstract, the JVM incorrectly delegates execution to an interface default method, potentially running unintended code. SUSE addressed this in Java 8.0 SR8 FP70; ...
CVE-2026-16441
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-16441
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
EUVD-2026-46338
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
CVE-2026-16439
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , but...
PT-2026-62111
Name of the Vulnerable Software and Affected Versions FOG versions prior to 1.5.10.1832 FOG versions prior to 1.6.0-beta.2313 Description The buildRow function in fogpage.class.php fails to perform HTML escaping when substituting data values into HTML table cell templates via str replace. An...
CVE-2026-64821: Cross-Site Request Forgery (CSRF)
djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...
PT-2026-62091
SQL Injection vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file...
CVE-2026-16441: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...