scarlgyx-cybersecurity

Scarlgyx Cybersecurity Writeups, notas y herramientas de cibe...

CVE-2026-69662: Improper Neutralization of Directives in Dynamically Evaluated Code

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...

PT-2026-102903

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...

CVE-2026-84648

A flaw was found in Jenkins. The system log viewer does not properly escape log record metadata, such as the source, level, and timestamp. This vulnerability allows attackers who control agent processes to inject malicious scripts. Successful exploitation can lead to a stored cross-site scripting...

EUVD-2026-87976

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters for exampl...

PT-2026-99251

Name of the Vulnerable Software and Affected Versions Optimole WordPress plugin versions prior to 4.2.13 Description The plugin fails to escape unrecognized attributes within its video-player block before rendering them onto the block's wrapper element. This allows users with the Author role or...

CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

PT-2026-98397

Name of the Vulnerable Software and Affected Versions Repeater Fields for Elementor Forms versions prior to 2.2.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...

CVE-2026-56744

"@bsv/wallet-toolbox" provides BRC-100 wallet signing and storage components, while "@bsv/wallet-toolbox-client" and "@bsv/wallet-toolbox-mobile" provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744

The @bsv/wallet-toolbox , @bsv/wallet-toolbox-client , and @bsv/wallet-toolbox-mobile packages contain a vulnerability where transactions created via a remote StorageClient do not verify that output locking scripts from the provider match the caller's requested outputs. A compromised provider cou...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Medium...

Cross-site Scripting (XSS)

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sanitizer process. An attacker can execute arbitrary scripts ...

PT-2026-97195

Name of the Vulnerable Software and Affected Versions Subscribe Forms versions prior to 1.6.3 Description Stored Cross-Site Scripting XSS occurs because the plugin fails to sanitize and escape a form setting before it is output on a page. This allows authenticated users with the Author role or...

PT-2026-97468

Name of the Vulnerable Software and Affected Versions The Post Grid versions prior to 7.9.6 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to properly sanitize...

CVE-2026-75744

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page...

CVE-2026-75689

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-75697

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...