173 matches found
CVE-2026-54208: Improper Input Validation
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...
CVE-2026-54217: Improper Input Validation
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528...
CVE-2026-54202: Absolute Path Traversal
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folde...
CVE-2026-54199: Improper Input Validation
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...
CLEANSTART-2026-ZX59706 Security fixes in grafana-rollout-operator 0.36.0-r0
Package grafana-rollout-operator version 0.36.0-r0 fixes 7 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...
CLEANSTART-2026-BI40968 Security fixes in grafana-rollout-operator 0.35.0-r0
Package grafana-rollout-operator version 0.35.0-r0 fixes 7 vulnerabilities: CVE-2026-25679, ghsa-p77j-4mvh-x3m3, CVE-2026-27138, CVE-2026-27137, CVE-2026-27142...
CLEANSTART-2026-MK41253 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-39882, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58 applied in versions: 0.36.0-r0, 0.36.0-r1
Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-MY03287 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-39882, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58 applied in versions: 0.36.0-r0, 0.36.0-r1
Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
CVE-2026-56323
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channelself endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary...
CVE-2026-56323
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channelself endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary...
EUVD-2026-38373
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channelself endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary...
PT-2026-51411
Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An information disclosure issue exists in the '/functions/v1/channel self' endpoint. Unauthenticated remote attackers can send GET requests using arbitrary app id parameters to enumerate non-public...
CLEANSTART-2026-EF68467 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-39882, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58 applied in versions: 0.36.0-r0, 0.36.0-r1
Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-MO33100 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-39882, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58 applied in versions: 0.36.0-r0, 0.36.0-r1
Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
Online Safety Regulation Increases Privacy Risk: Evidence from the UK Online Safety Act
Governments worldwide are increasingly regulating digital platforms to reduce online harms, particularly those affecting children. However, access restrictions can alter user behaviour and introduce new privacy and security risks. The UK Online Safety Act OSA, passed in October 2023, illustrates...
May 26, 2026—KB5089570 (OS Build 28000.2179) Preview
None None...
May 26, 2026—KB5089573 (OS Builds 26200.8524 and 26100.8524) Preview
None None...
CLEANSTART-2026-UY10441 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33810, CVE-2026-39882, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58 applied in versions: 0.36.0-r0, 0.36.0-r1
Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
Microsoft is changing Edge’s plaintext password behavior
Microsoft said it will change Edge’s password handling as a “defense‑in‑depth” measure. Originally, Edge decrypted the entire saved‑password store on startup and kept all credentials resident in process memory in clear text for the whole browser session, regardless of whether a given credential w...