1284 matches found
CLEANSTART-2026-OI70918 Security fixes for CVE-2026-33870, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, ghsa-2c5c-chwr-9hqw, ghsa-38f8-5428-x5cv, ghsa-72hv-8253-57qq, ghsa-f6hv-jmp6-3vwv, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-pwqr-wmgm-9rr8 applied in versions: 2.19.5-r0, 3.6.0-r4
Multiple security vulnerabilities affect the opensearch package. These issues are resolved in later releases. See references for individual vulnerability details...
CVE-2026-44230
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...
CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...
CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...
CVE-2026-44228
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...
CVE-2026-44228 RT: Stored Cross-Site Scripting via insufficient template escaping
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...
CVE-2026-44228 RT: Stored Cross-Site Scripting via insufficient template escaping
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...
CVE-2026-44227 RT: Reflected Cross-Site Scripting via URL parameters
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...
CVE-2026-44227
RT (Rocket Tickets) is affected in versions 6.0.0 and above up to, but not including, 6.0.3, where a reflected XSS vulnerability exists in URL parameters. An attacker who can lure an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user’s browser session, with...
CVE-2026-44227 RT: Reflected Cross-Site Scripting via URL parameters
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...
CVE-2026-44974
CVE-2026-44974 affects the @hapi/content header parser. Before v6.0.2, Content.disposition() kept the last value for duplicate parameters while Content.type() kept the first for duplicate charset/boundary parameters, creating a parameter-smuggling primitive when duplicates are resolved inconsiste...
EUVD-2026-45166
Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0...
SUSE-SU-2026:22793-1 Security update for the Linux Kernel RT (Live Patch 12 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-36.1 fixes various security issues: The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...
PT-2026-60894
Name of the Vulnerable Software and Affected Versions plone.app.textfield versions prior to 2.0.2 plone.app.textfield versions prior to 3.0.2 plone.app.textfield versions prior to 4.0.1 Description A stored Cross-Site Scripting XSS issue affects RichText fields. The RichTextValue.output function...
CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...
CVE-2025-53379
Fortinet FortiAuthenticator is affected by CVE-2025-53379, an out-of-bounds read vulnerability in FortiAuthenticator 6.6.0–6.6.2 and all 6.5 versions. A remote unauthenticated attacker could potentially retrieve sensitive information via a specially crafted request. The CVSSv3.1 vector is NETWORK...
PYSEC-2026-2626 Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures
Summary The readonly mode in mcp-neo4j-cypher versions prior to 0.6.0 can be bypassed using CALL procedures. Details Impact The enforcing of readonly mode in vulnerable versions could be bypassed by certain APOC procedures. Patches v0.6.0 release hardened the checks around the mode. The only way ...
PYSEC-2026-2448 Django vulnerable to Uncontrolled Resource Consumption
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...
PYSEC-2026-2376 Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language DML statements...