CVE-2026-11429

creationtimestamp| type| source ---|---|--- 2026-06-05 23:25:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlbxhyq522a 2026-06-06 00:00:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnldvvpv6p2k 2026-06-06 00:00:41+00:00| seen|...

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Description Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName straight into its HTML output without escaping: php protected function formatTemplateProfile $profile, $prefix: string return \sprintf'%s└ %s', $prefix, self::$colors'template', $profile-getTemplate; The...

GHSA-2G2G-8P8H-FGWM Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Description Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName straight into its HTML output without escaping: php protected function formatTemplateProfile $profile, $prefix: string return \sprintf'%s└ %s', $prefix, self::$colors'template', $profile-getTemplate; The...

CVE-2026-46397

creationtimestamp| type| source ---|---|--- 2026-06-05 21:40:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl42opps527...

CVE-2026-46398

creationtimestamp| type| source ---|---|--- 2026-06-05 21:35:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl3rq4wz32z...

CVE-2026-46400

creationtimestamp| type| source ---|---|--- 2026-06-05 21:30:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl3iqrl6u2f...

CVE-2026-45777

creationtimestamp| type| source ---|---|--- 2026-06-05 20:57:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzp3hx2y2k 2026-06-06 09:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnmc35xzgd2f 2026-06-06 09:00:35+00:00| seen|...

CVE-2026-45778

creationtimestamp| type| source ---|---|--- 2026-06-05 20:55:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzklr64m2g...

CVE-2026-11419

creationtimestamp| type| source ---|---|--- 2026-06-05 20:50:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzcm7lbt24 2026-06-06 04:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnlsyefnvw23 2026-06-06 04:30:42+00:00| seen|...

CVE-2026-41659

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint membersassignmentdata.php includes hidden profile fields BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY in its SQL search condition regardless of field visibility settings. While the...

CVE-2026-10807

A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/changeprofileimage.php. Executing a manipulation of the argument prprofileimage can lead to unrestricted upload. The attack may be launched remotely. The...

CVE-2026-36388

A Cross-Site Scripting XSS vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. This flaw allows an authenticated attacker patient to inject a malicious script payload into the User Name parameter, which is stored in the application and...

CVE-2026-9224

Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request. This issue affects : Devolutions Server 2026.1.6.0 through 2026.1.16.0 Devolutions Server 2025.3.20.0 and...

CVE-2026-8291

A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogsnnrfnfmhandlenfprofile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to...

CVE-2026-2379

creationtimestamp| type| source ---|---|--- 2026-06-05 19:42:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkvhtescw26...

CVE-2026-43877

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo.png. Its only access control is User::isLogged. It does not...

CVE-2026-7457

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0. This is due to insufficient input sanitization on the customer cabinet profile update endpoint — where raw POST parameters firstname, lastname, phone, notes bypass sanitizati...

CVE-2026-34280

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft component: Job Profile Manager. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-45299

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, the profileimageurl field on the user profile update form accepted arbitrary data: URI values without MIME-type validation, resulting in a XSS vulnerability. This vulnerability is...

CVE-2026-45749

creationtimestamp| type| source ---|---|--- 2026-06-05 19:32:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkuvqnebc27 2026-06-05 22:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnl57gryph26 2026-06-08 22:37:06+00:00| seen|...