116697 matches found
WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...
PT-2026-71786
Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...
PT-2026-80575
Add basic validation for content proxied by the css proxy Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is local url check Fix remote content blocking bypass via unclosed url in...
SUSE SLES15 Security Update : dracut (SUSE-SU-2026:3599-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3599-1 advisory. This update for dracut fixes the following issue: Update to version 055+suse.367.g85633e8. Securitys issue fixed: - CVE-2026-15816: root cod...
ALSA-2026:54571 Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
CVE-2026-73648: Improper Neutralization of Input During Web Page Generation
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...
ALSA-2026:54575 Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
ALSA-2026:54576 Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
CVE-2026-73422
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:16+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6...
CVE-2026-18099 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...
CVE-2026-18099
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...
Malicious code in bb-twl-k7x2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...
Malicious code in @years20/n8n-nodes-utils-helper-g (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd,...
Malicious code in @years20/n8n-nodes-utils-helper-i (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30 The package presents itself as an n8n helper node but ships only a stub node nodes/PwnNode.node.js and a postinstall script callback.js, duplicated a...
Malicious code in @years20/n8n-nodes-utils-helper-j (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...
Malicious code in @years20/n8n-nodes-utils-helper-h (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3 Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file nodes/PwnNode.node.js, self-labeled 'Pwn'. The rea...
CVE-2026-65937
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...
EUVD-2026-57262
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only striptags applied directly into $pagetitle. A single quote terminates the JS string, executing arbitra...