45633 matches found
ColdFusion Path Traversal
The vulnerability of the ColdFusion interpreter is related to incorrect restrictions on path names to the catalog. Exploiting this vulnerability allows an attacker who operates remotely to read arbitrary files...
ROS-20260420-73-0043
Vulnerability in incus related to incorrect path name restriction to a restricted directory. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...
ERP Online security vulnerabilities
ERP Online is an enterprise management system developed by ERP Online Company. Versions of ERP Online 4.0.0 and earlier contained security vulnerabilities. These vulnerabilities were caused by improper handling of parameters named “Item Name” in the “Inventory Edit Item Page” component, which cou...
PT-2026-33781
A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page. The manipulation of the argument Item Name results in cross site scripting. The attack may be launched remotely. The exploit has been...
ColdFusion Path Traversal
The vulnerability of the ColdFusion interpreter is related to incorrect restrictions on path names in the catalog. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...
zeek -- potential DoS vulnerabilities
Tim Wojtulewicz of Corelight reports: A series of DNS messages containing long DNS compression chains can cause Zeek to spend a long time processing packets and potentially crash. Due to the fact that these packets can be received from remote hosts, this is a DoS risk. A specially-crafted LDAP...
RLSA-2026:8352 Important: bind security update
The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...
Cross-site Scripting (XSS)
Decidim is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input in the user name field, which allows an attacker to inject and execute arbitrary code when other users view affected pages...
CVE-2026-40593 ChurchCRM: Stored XSS in UserEditor.php via Login Name Field
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor UserEditor.php renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars. An administrator can save a username containing HTML attribute-breaking characte...
CVE-2026-40593 ChurchCRM: Stored XSS in UserEditor.php via Login Name Field
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor UserEditor.php renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars. An administrator can save a username containing HTML attribute-breaking characte...
CVE-2026-40593
CVE-2026-40593 affects ChurchCRM prior to 7.2.0. The issue arises in the UserEditor.php when rendering stored usernames into an HTML input value without applying htmlspecialchars(), allowing an administrator to save a username with HTML attribute-breaking characters and event handlers. When anoth...
SUSE SLES12 Security Update : avahi (SUSE-SU-2026:1442-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:1442-1 advisory. This update for avahi fixes the following issue: - CVE-2026-24401: avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : avahi (SUSE-SU-2026:1441-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1441-1 advisory. This update for avahi fixes the following issue: - CVE-2026-24401: avahi-daemon can be crashed via a...
ruby: multiple insufficient safe mode restrictions
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...
External Control of File Name or Path
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of File Name or Path via improper validation of file paths in the media embedding. An attacker can access arbitrary files on the host system or trigger network credential...
CVE-2026-40286
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability was identified in the 'Member Registration' Cadastrar Sócio function. By injecting a payload into the 'Member Name' Nome Sócio field, the script is persistently stored ...
CVE-2026-40286 WeGIA has Cross-Site Scripting in Controle de Contribuição
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability was identified in the 'Member Registration' Cadastrar Sócio function. By injecting a payload into the 'Member Name' Nome Sócio field, the script is persistently stored ...
CVE-2026-40286
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability was identified in the 'Member Registration' Cadastrar Sócio function. By injecting a payload into the 'Member Name' Nome Sócio field, the script is persistently stored ...
EUVD-2026-23531
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability was identified in the 'Member Registration' Cadastrar Sócio function. By injecting a payload into the 'Member Name' Nome Sócio field, the script is persistently stored ...
CVE-2026-40286 WeGIA has Cross-Site Scripting in Controle de Contribuição
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability was identified in the 'Member Registration' Cadastrar Sócio function. By injecting a payload into the 'Member Name' Nome Sócio field, the script is persistently stored ...