26829 matches found
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2026-71285
Uptime Kuma’s Matomo analytics integration (server/analytics/matomo-analytics.js) is affected. The admin-configurable Matomo siteId is injected as a bare, unquoted JavaScript expression inside a [removed] block on every public status page: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);....
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2026-64581
creationtimestamp| type| source ---|---|--- 2026-08-05 12:15:26+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-64581 2026-09-04 12:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoy24g4c32a...
CVE-2026-4431
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...
MINI-794H-PMJQ-C77X
Bulletin has no description...
CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint
The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...
CVE-2026-55998
The CVE describes an unauthenticated import endpoint vulnerability: /v3/import/{token}_{clusterId}.yaml returns 502 for valid cluster IDs that reference clusters with private registry secrets due to a null pointer dereference in pkg/systemtemplate/private_registry.go ; non-existent cluster IDs re...
EUVD-2026-53285
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...
CVE-2026-4431
The CVE-2026-4431 entry concerns the Easy Post Submission WordPress plugin (up to version 2.3.0). A missing capability check on create_post() enables an unauthenticated actor to invoke the rbsm_submit_post AJAX action (registered via wp_ajax_nopriv_rbsm_submit_post) without authorization when a p...
CVE-2026-4431
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...
CVE-2026-67623: Inclusion of Functionality from Untrusted Control Sphere
Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...
PT-2026-68171
Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.23.3 Description A remote code execution issue exists where attackers can execute arbitrary commands by embedding a malicious core.fsmonitor hook within a repository's .git/config file. This is triggered when t...
OpenSSL 3.6.0 < 3.6.4 Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 3.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.6.4 advisory. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and n...
OpenSSL Security Advisory 20260805
OpenSSL Security Advisory 20260805 - A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries...
GHSA-3CG5-48J3-V4GV
creationtimestamp| type| source ---|---|--- 2026-08-04 21:31:22+00:00| seen| https://gist.github.com/alon710/e57220ec033758e1c7ba8d20ade18b9d...
CVE-2026-0163
creationtimestamp| type| source ---|---|--- 2026-08-04 19:21:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117038861597097181 2026-08-04 21:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbwhpxgff2u 2026-08-05 10:34:59+00:00| seen|...
CVE-2026-6837
creationtimestamp| type| source ---|---|--- 2026-08-04 14:06:53+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msb6peubta2r 2026-08-04 14:06:56+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117037623751892634 2026-08-17 18:00:04+00:00| seen|...
CVE-2026-18612
creationtimestamp| type| source ---|---|--- 2026-08-04 12:16:18+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msayjnlhrc2j 2026-08-04 12:16:19+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117037188953476018 2026-08-04 16:00:44+00:00| seen|...