138056 matches found
CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...
CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...
Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9rj7-rf2p-w77r. This link is maintained to preserve external references. Original Description GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options...
CVE-2026-75953
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...
CVE-2026-40509 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
CVE-2026-40509
OpenEMR before 8.3.0 is affected by a cross-site request forgery (CSRF) vulnerability in the DICOM viewer . The web_path GET parameter is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a malicious URL that causes an authenticated user holding...
EUVD-2026-62510
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
CVE-2026-40507 OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...
CVE-2026-40507 OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...
EUVD-2026-62504
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...
CVE-2026-40507 OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...
CVE-2026-18756 HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...
CVE-2026-75955 Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...
EUVD-2026-62491
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...
CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...
CVE-2026-75956
J-BusinessDirectory (a Joomla extension by cmsjunkie.com) versions prior to 6.2.3 are vulnerable to a denial-of-service condition in pagination parameter handling. The root cause is insufficient input validation: pagination values were not strictly typed, so array or non-numeric values (e.g., lim...
CVE-2026-76233
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...
CVE-2026-75114
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate in Zoo 4.1.64 - The referer request parameter is passed straight to setRedirect with no validation...