302932 matches found
GHSA-VRH8-C9CM-WH8V ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...
CVE-2026-18117
Concrete CMS 9.0.0 through 9.5.3 contains a stored XSS vulnerability in the custom page alias name (customAliasName) field. The root cause is that the Edit Alias dialog applied only trim() to the submitted value without performing input neutralization. An authenticated user with canWrite (editor)...
CVE-2026-18117 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...
CVE-2026-18117 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...
CVE-2026-18117 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...
CVE-2026-86917
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...
CVE-2026-84631
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges...
CVE-2026-84622
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app with root privileges may be able to read...
CVE-2026-84505
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...
CVE-2026-68489
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...
CVE-2026-65362
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...
CVE-2026-65359
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination o...
CVE-2026-64790
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain elevated privileges...
CVE-2026-64712
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...
CVE-2026-64701
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges...
CVE-2026-43783
A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges...
CVE-2026-43786
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...
CVE-2026-43691
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...
