EUVD-2026-64150

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-76905

kin-openapi (Go library for OpenAPI processing) versions 0.10.0 through 0.141.0 contain a nil-pointer dereference in openapi3filter.convertParseError (openapi3filter/validation_error_encoder.go). The function accesses e.Parameter.In without checking whether e.Parameter is nil. A malformed non-str...

EUVD-2026-64148

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...

CVE-2026-30890

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script (synchro/synchro_import.php). The flaw allows an attacker with low privileges to inject malicious scripts that execute in the context of a victim...

EUVD-2026-64147

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality . The flaw allows an attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary script in the victim's browser c...

EUVD-2026-64142

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

CVE-2026-30819

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...

CVE-2026-30826

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3 , a Reflected Cross-Site Scripting (XSS) vulnerability exists in the testing OQL query functionality of run_query.php. An attacker with low privileges can craft a malicious link that, when clicked by a user, executes a...

CVE-2026-30826 Combodo iTop: Reflected XSS in run_query.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

EUVD-2026-64135

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

EUVD-2026-64134

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-30819 Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...

CVE-2026-30819

Combodo iTop versions prior to 3.2.3 are affected by a reflected Cross-Site Scripting (XSS) vulnerability in the dashboard revert functionality. The vulnerable parameter is dashboard_id in the endpoint /pages/ajax.render.php . An attacker with low privileges and the ability to induce user interac...

EUVD-2026-64127

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

CommScope Ruckus IoT Controller - Information Disclosure

CommScope Ruckus IoT Controller is susceptible to information disclosure vulnerabilities because a 'service details' API endpoint discloses system and configuration information to an attacker without requiring authentication. This information includes DNS and NTP servers that the devices use for...

CVE-2026-26080

A flaw was found in HAProxy. An attacker can exploit a vulnerability where the software mishandles varint variable-length integer encoding. This can cause HAProxy to enter an infinite loop or crash, leading to a denial of service for affected systems...

CVE-2026-43820

A flaw was found in swift-nio-ssl. This vulnerability arises from the improper handling of Subject Alternative Names SANs within SSL certificates. When processing SANs that are not backed by an ASN1STRING, the system attempts to access memory outside of its allocated buffer, leading to an...

CVE-2026-25800

A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in the Assembler component, causing memory exhaustion and a...