44723 matches found
CVE-2026-59232 Stored Cross-site Scripting in Prospero Flow CRM lead name field
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...
CVE-2026-59232 Stored Cross-site Scripting in Prospero Flow CRM lead name field
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...
CVE-2026-59232 Stored Cross-site Scripting in Prospero Flow CRM lead name field
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...
CVE-2026-17346
CVE-2026-17346 affects pgAdmin 4 (Index Statistics sink for all-indexes listing in 1.0 and Publications/Subscriptions sinks in 5.0 prior to 9.17). The issue arose after CVE-2026-12044 fix: templates for sixteen COMMENT ON / pgstattuple / pgstatindex were hardened with qtLiteral, but several sinks...
Malicious Package
Overview @0xlr/stripe-frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Microsoft Edge for Android Information Disclosure Vulnerability
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally...
Microsoft Edge for Android Information Disclosure Vulnerability
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...
CVE-2026-18206
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...
[SECURITY] Fedora 43 Update: unbound-1.25.2-1.fc43
Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...
SUSE CVE-2026-5199
A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow IDs and, for signal operations, signal names. This was due to a bu...
SUSE CVE-2026-16313
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
PT-2026-66887
Name of the Vulnerable Software and Affected Versions NLTK affected versions not specified Description An issue exists in the FramenetCorpusReader.framename function where a caller-supplied frame name is interpolated into an XML file path. This allows a path traversal attack using ../ sequences t...
CVE-2026-59232: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...
PT-2026-66888
Name of the Vulnerable Software and Affected Versions NLTK affected versions not specified Description An SSRF filter in nltk.pathsec is bypassable via DNS rebinding. The validate network url function resolves a hostname to check if the IP is within blocked ranges loopback, private, link-local, o...
Google Chrome FileSystem API DoS
The vulnerability of the Google Chrome browser’s FileSystem API interface is related to the use of a name with an incorrect link. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
Unbound DNS Server Code Execution
The vulnerability of the Unbound DNS server is related to numerical truncation errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Unbound DNS DoS
The vulnerability of the Unbound DNS server is related to insufficient validation of input data and improper implementation of functions. Exploiting this vulnerability can allow a malicious actor to cause service failures...
Unbound DNS DoS
The vulnerability of the Unbound DNS server is related to improper blocking of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...
Fedora 43 : unbound (2026-3170ee6a1c)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3170ee6a1c advisory. Update to 1.25.2 rhbz2506061 Security fixes: - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC...
