Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

CVE-2026-16732

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

SUSE-SU-2026:22564-1 Security update for apache2

This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976. - CVE-2026-29170: modproxyftp XSS bsc1267977. - CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. - CVE-2026-34356: malicious backend servers can lead to a heap-based buffer...

CVE-2021-26830

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

CVE-2006-1976

Cross-site scripting XSS vulnerability in addRequest.php in Prayer Request Board PRB Beta 1 before 20060320 allows remote attackers to inject arbitrary web script or HTML via the Request field...

unit:Fuzz_http: Object-size in nxt_http_request_field

Detailed Report: https://oss-fuzz.com/testcase?key=6323347030147072 Project: unit Fuzzing Engine: libFuzzer Fuzz Target: Fuzzhttp Job Type: libfuzzerubsanunit Platform Id: linux Crash Type: Object-size Crash Address: Crash State: nxthttprequestfield nxthttpfieldsprocess nxthttpparsefuzz Sanitizer...

CVE-2022-0701

The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

8: Enrolling certificate without certreq field causes CA to crash

An input validation error was found in Red Hat Certificate System's handling of client provided certificates. If the certreq field is not present in a certificate an assertion error is triggered causing a denial of service...

IniNet Solutions GmbH SCADA Web Server Code Execution

The multiple vulnerabilities of IniNet Solutions GmbH’s SCADA Web Server are caused by buffer overflows in the stack. Exploitation of these vulnerabilities could allow a malicious actor to execute arbitrary code using a long HTTP request field...

Cross site scripting

Cross-site scripting XSS vulnerability in addRequest.php in Prayer Request Board PRB Beta 1 before 20060320 allows remote attackers to inject arbitrary web script or HTML via the Request field...

CVE-2006-1976: Undefined Security Weakness

Cross-site scripting XSS vulnerability in addRequest.php in Prayer Request Board PRB Beta 1 before 20060320 allows remote attackers to inject arbitrary web script or HTML via the Request field...