Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...

Arbitrary File Upload

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

GHSA-R5MF-4R5X-Q78F Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

CVE-2025-64392

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link...

EUVD-2026-94254

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2...

CVE-2025-64392

CVE-2025-64392 is a reflected cross-site scripting (XSS) vulnerability in Veeam Backup Enterprise Manager . It allows an attacker to execute scripts in the browser of an authenticated portal user who opens a crafted link. This flaw affects Veeam Backup Enterprise Manager (Veeam Backup & Replicati...

CVE-2025-64392

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link...

EUVD-2025-211040

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link...

CVE-2025-64392

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link...

CVE-2025-64392: Improper Neutralization of Input During Web Page Generation

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link...

PT-2026-107423

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link...

CVE-2026-105791

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the runshell tool in the CommandLineExecutor component of ufo/client/mcp/localservers/climcpserver.py validates only the first token of the bashcommand parameter and permits...

CVE-2026-84370

A flaw was found in SVGO SVG Optimizer, a Node.js library for optimizing SVG files. The removeScripts plugin, intended to filter executable links, incompletely processes namespace-prefixed SVG anchor elements and fails to remove ASCII control characters before validating URL schemes. A remote...

Veeam Backup and Replication < 12.3.2 (kb4934)

The version of Veeam Backup and Replication installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4934 advisory. - A reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager allows an attacker to execut...

Cisco ASA Cross-site Scripting (CVE-2019-1701)

Multiple vulnerabilities in the WebVPN service of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the WebVPN portal of an affected device. Th...

CVE-2026-77226

The Camunda engine, specifically versions 7.24.0 before 7.24.15 , is vulnerable to an incorrect authorization flaw in the Admin web application's first-run setup endpoint. The SetupResource component incorrectly determines setup availability by only counting direct members of the camunda-admin gr...

CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

CVE-2026-102576

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

Astra Linux – Vulnerability in Apache2

A substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attackers to execute scripts in directories permitted by the configuration, but these directories are not directly accessible via URLs. Additionally, the source of scripts intended for execution only as CG...

Astra Linux – Vulnerability in Apache2

There is a vulnerability in the core of the Apache HTTP Server version 2.4.59 and earlier. This vulnerability allows for information disclosure, SSRF attacks, or local script execution through backend applications whose response headers are malicious or exploitable. Users are recommended to upgra...