CVE-2026-92225 Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260912 - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector...

CVE-2022-51019

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2026-49243 Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

CVE-2026-49243 Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

CVE-2026-49243 Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

CVE-2026-49243

The web-based system administration tool Webmin is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in its Configuration module in versions prior to 2.650 . This vulnerability occurs due to the improper neutralization of input during web page generation, allowing an attacker to execute a...

Server-Side Request Forgery

Apache Shiro is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of the form‑resubmit target in the Jakarta EE integration module, where the server will initiate an outbound connection to a URL supplied in a crafted HTTP request and transmit...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module tar (CVE-2026-59871, CVE-2026-59873, CVE-2026-59874 and CVE-2026-59875)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to Node.js module tar. Vulnerability Details CVEID:CVE-2026-59871 DESCRIPTION: node-tar ...

USN-8841-1: Perl DBI module vulnerabilities

It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-73193, CVE-2026-73194...

CLEANSTART-2026-EM39649 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

CVE-2026-56865 affects multiple packages. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. See references for individual vulnerabilit...

CLEANSTART-2026-QU13613 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

CVE-2026-56864 affects multiple packages. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

PT-2026-102759

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txm module manager memory load / txm module manager in place load — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXM MODULE PREAMBLE is full...

CVE-2026-102757: Out-of-bounds Read

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereferenc...

Z-Sigil: A Public-Key Cryptosystem with Chained Selection over a Fiber Bundle of Module-Lattice Keys

Z-Sigil is a public-key cryptosystem in which the plaintext selects successive keys from a fixed module-lattice family. Messages are length-prefixed, zero-padded and divided into 32-byte blocks. Each public vector is a shared public matrix applied to a small secret vector, plus a small error. Key...

CVE-2022-51019: Improper Neutralization of Special Elements used in an OS Command

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2026-102711: Out-of-bounds Read

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2024-31026: Improper Control of Generation of Code

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

Debian dla-4799 : python-lxml-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4799 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4799-1 [email protected]...

PT-2026-102769

Name of the Vulnerable Software and Affected Versions ThreadX affected versions not specified Description An unprivileged, memory-protected module can force the kernel to read and write memory at arbitrary addresses in privileged mode, allowing the module to clear the MPU Memory Protection Unit...