CVE-2026-12459

An inappropriate implementation in the Serial component of Google Chrome (and Microsoft Edge ) prior to version 149.0.7827.155 allows a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. This User Cross-Site Scripting (UXSS) vulnerability can lead to the disclosure of co...

PT-2026-50448

Name of the Vulnerable Software and Affected Versions OpenStack Horizon versions prior to 25.7.4 Description OpenStack Horizon produces scripts for OpenStack RC file downloading that may contain a crafted project name with shell metacharacters. Shell metacharacters are special characters...

PT-2026-50433

Name of the Vulnerable Software and Affected Versions Dell PowerFlex Manager affected versions not specified Description A missing authentication for critical function issue exists. An unauthenticated attacker with adjacent network access could exploit this to achieve code execution, denial of...

PT-2026-50608

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The rebuild.php front controller, used to clear caches and rebuild the container when a site is in an unexpected condition, fails to correctly validate the Host header against trusted hos...

Discuz! X5.0 Plugin Access Control Checker

This Metasploit module checks whether the enabledisable.php endpoint is accessible without proper authentication in Discuz! X5.0. It does not exploit any vulnerability...

CVE-2026-12459: Undefined Security Weakness

Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal clearing the caches and rebuilding the container when the site is in an unexpected condition. This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cac...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...

PT-2026-50464

Name of the Vulnerable Software and Affected Versions Dell PowerFlex Manager affected versions not specified Description An improper neutralization of special elements used in an SQL command allows a low privileged attacker with adjacent network access to perform SQL injection, which could...

CVE-2026-35069: Improper Neutralization of Special Elements used in an SQL Command

Dell PowerFlex Manager, versions prior to 5.1.0.1, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code within the authorized user’s session...

MAL-2026-5937 Malicious code in abuden21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4db5b16c4a10377beb73341758a26afed16a44d377dc03009601f610dd289b22 The tarball ships auto-publish.sh, which iterates a hardcoded list of 90 unrelated package names imillegal1..N, ishowfeet, nottuff, abuden,...

Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Potential XSS in HTML session exports via Markdown URL handling Pi HTML exports render session Markdown into a static HTML file. Affected versions did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme cou...

MAL-2026-5938 Malicious code in speed4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766e347295e7a13e0604a89de30f662a24b690598f1e4b01edaac5400178347 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...