262239 matches found
CVE-2026-9588
A stored cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997 within the voicemail notification template functionality. The submitmodifyvoicemailtemplate endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious...
EUVD-2026-45186
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...
GHSA-36HH-V3QG-5JQ4 vulnerabilities
Vulnerabilities for packages: py3-xet-core...
GHSA-6GFG-HH9C-WX87 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-15778 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-15777 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-16017 mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/toolcron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the...
EUVD-2024-55670
HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing CORS policy for this request that allows access from any domain -Wildcard...
CVE-2024-23569
The CVE-2024-23569 entry concerns HCL Aftermarket EPC where the server is not configured with the X-XSS-Protection header. Connected documents indicate the affected component is HCL Aftermarket EPC, with root cause described as missing the X-XSS-Protection header, and a CVSS 3.1 base score of 4.3...
EUVD-2024-55665
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more focused attack...
EUVD-2024-55661
HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program...
CVE-2024-23565
CVE-2024-23565 affects HCL Aftermarket EPC. The vulnerability arises from a lack of proper mail-rate limiting in the Forget Password workflow, allowing email flooding by a human attacker or automated process (virus/bot). Consequences cited include potential denial of service and logic/other impac...
EUVD-2024-55660
HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated attacks & account enumeration...
CVE-2026-13082
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a by default six-character string. The built-in rand function is...
EUVD-2026-45170
Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026...
kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop
A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture aloop driver. This Use-After-Free UAF vulnerability occurs when loopbackcheckformat stops the capture side during a format change, while a concurrent close operation detaches or frees the runtime. An attacker could...
kernel: dlm: validate length in dlm_search_rsb_tree
A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...
CVE-2026-13410
CVE-2026-13410 affects Dancer::Plugin::Auth::Google for Perl up to version 0.07, where TLS verification is disabled in the library and the default user agent SSL_verify_mode is turned off. This enables a network (MITM) attacker between the Dancer app and googleapis.com to intercept the OAuth2 tok...
CVE-2026-15714
creationtimestamp| type| source ---|---|--- 2026-07-17 11:02:39+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqtlzeaocf23 2026-07-17 11:02:42+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqtlzhg67b24 2026-07-17 11:02:45+00:00| seen|...