BUI-select-xss

BUI-select-xss cve-2018-8108 During a security test, this issue was discovered by chance. BUI is a front-end framework used by many enterprises to build their own front-end applications. Typically, we prevent XSS by treating all user input as untrusted, escaping it during output, and then passing...

CVE-2026-29187_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-29187 - SQL Injection Vulnerability in new search popup Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not...

CVE-2026-65321-pyathena

CVE-2026-65321: SQL Injection in PyAthena via Backslash Quote-Escaping for Non-SELECT Statements Severity: Critical, CVSS v4.0 9.3 / CVSS v3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1:...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL Injection Environment Initialization 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Vulnerability Reproduction 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FRO...

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

CVE-2026-32710

CVE-2026-32710 Heap buffer overflow in MariaDBJSONSCHEMAVALID → persistent privilege escalation → UDF RCE | ---|--- Affected| MariaDB 11.4.x confirmed on 11.4.9 Bug| OOB write in jsongetnormalizedstring — strncpy into 128-byte DYNAMICSTRING with no bounds check Impact| SELECT-only user → ALL...

sqlite-xfer-auth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-xfer-auth Write-up: https://abraxaslabs.tech/research/sqlite-xfer-auth sqlite-xfer-auth Class: Privilege leftover Reach: Local SQLite 3.53.4 b09c88c, SOURCEID 2026-07-24 19:02:57...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary File Upload → RCE CVSS 9.8 Critical · Affected: Forminator = 1.56.1 · Patched: 1.56.2 Researcher: daroo Wordfence Bug Bounty, $2,048 · 600k active installs Writeup:...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Proof-of-Concept A Proof-of-Concept PoC exploit for CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Description This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability...

CVE-2026-116797

Highcharts Grid Pro, versions 2.0.0 through 3.2.0 , is vulnerable to a Cross-Site Scripting (XSS) flaw via CWE-79 . The root cause is the use of raw setAttribute calls to copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements. An attacker contro...

CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

SUSE SLES16: cpupower / cpupower-bash-completion / cpupower-bench / etc (SUSE-SU-2026:24362-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24362-1 advisory. This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open...

K000163893: Linux kernel vulnerability CVE-2026-46148

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: control built-in cs manually The coreQSPI IP supports only a single chip select, which is automagically operated by the hardware - set low when the transmit buffer first get...

Google Chrome Edge Select Component Access

The vulnerability in the Select component of Google Chrome and Microsoft Edge web browsers is related to information disclosure due to a mismatch. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

SUSE SLED15: cpupower / cpupower-bash-completion / cpupower-devel / etc (SUSE-SU-2026:4890-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4890-1 advisory. This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon...

openSUSE 16: cpupower / cpupower-bash-completion / cpupower-bench / etc (openSUSE-SU-2026:22155-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22155-1 advisory. This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open bsc1278335. Changes...

Security update for cpupower

This update for cpupower fixes the following issue: CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open bsc1278335. Changes for cpupower: Release to latest kernel-source including: intel-speed-select: Harden daemon pidfile open CVE-2026-80663 bsc1278335 cpupower: Fix...

SUSE-SU-2026:4890-1 Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open bsc1278335. Changes for cpupower: - Release to latest kernel-source including: intel-speed-select: Harden daemon pidfile open CVE-2026-80663 bsc1278335 cpupower: Fi...

Security update for cpupower (important)

openSUSE security update: security update for cpupower ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22155-1 Rating: important References: bsc1278335 Cross-References: CVE-2026-80663 CVSS scores: CVE-2026-80663 SUSE : 7.1...