122983 matches found
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter
Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...
GO-2026-6457 rclone: source object names can escape the configured root on upload in github.com/rclone/rclone
rclone: source object names can escape the configured root on upload in github.com/rclone/rclone...
CVE-2026-92380
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...
CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...
CVE-2026-92380
WuzhiCMS up to 4.1.0 is affected by a server-side request forgery (SSRF) vulnerability in the Remote Image Fetch component. The flaw resides in the function ckditor::saveRemote within coreframe/app/attachment/index.php , where manipulation of the source[] argument allows an unauthenticated, remot...
CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...
EUVD-2026-80792
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...
CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...
DEBIAN-CVE-2026-89840
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVERANGE destination size F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose this: cloneblkaddrs skips NULLADDR entries and returns success, so th...
CVE-2026-86784
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...
CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...
CVE-2026-86784
The Visualizer WordPress plugin (versions before 4.0.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise and escape a chart's JSON data source configuration before it is output back in the chart editor. This allows users with Contributor role p...
EUVD-2026-80205
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...
CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...
testkube v2.13.2
The Open Testing Platform for AI-driven Engineering Teams Testkube provides a single platform for defining, running and analyzing automated tests, using your existing testing tools/scripts, running in your Kubernetes infrastructure...
CVE-2026-83269
creationtimestamp| type| source ---|---|--- 2026-09-16 02:12:48+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvm2u3nuct2t 2026-09-16 04:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmatwdqw42f 2026-09-16 16:00:43+00:00| seen|...
CVE-2026-83282
creationtimestamp| type| source ---|---|--- 2026-09-16 01:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlzlhlam52n 2026-09-16 02:12:57+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvm2udztim2w 2026-09-16 16:00:43+00:00| seen|...
EUVD-2026-80007
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...
CVE-2026-83154
creationtimestamp| type| source ---|---|--- 2026-09-16 00:13:54+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlu7i6j742g 2026-09-16 03:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvm76dl4zg24 2026-09-22 12:37:07+00:00| seen|...