CVE-2026-6735

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

UBUNTU-CVE-2026-6735

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

CVE-2026-6735 XSS within PHP-FPM status endpoint

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

CVE-2026-6735

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

CVE-2026-6735

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

CVE-2026-6735

CVE-2026-6735 affects PHP with XSS on the PHP-FPM status page due to improper sanitization of user data. Affected branches include PHP 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6. Consequence: an attacker can craft a URL that causes the target to execute ...

CVE-2026-6735

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

CVE-2026-6735 XSS within PHP-FPM status endpoint

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

EUVD-2026-28967

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machine when the target is viewing...

PT-2026-42550

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.641 Description A stored cross-site scripting issue exists in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary commands by...

PHP 跨站脚本漏洞

PHP is an open-source scripting language executed on the server side. Versions of PHP prior to 8.2.31, 8.3.31, 8.4.21, and 8.5.6 had a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of user data, allowing attackers to construct URLs that allowed arbitrary...

CVE-2026-45347

creationtimestamp| type| source ---|---|--- 2026-05-09 22:47:27+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-f776-fp4w-266c 2026-05-16 00:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlwmx6fwfz2t...

CVE-2026-8195

creationtimestamp| type| source ---|---|--- 2026-05-09 22:00:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhalbqgdr2e...

CVE-2026-8234

creationtimestamp| type| source ---|---|--- 2026-05-09 16:45:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116545626763451374 2026-05-10 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116549106106707429 2026-05-10 07:30:28+00:00| seen|...

Exploit for Write-what-where Condition in Linux Linux_Kernel

Dirty Frag check CVE-2026-43284 / CVE-2026-43500 Read-only...

OESA-2026-2209 postfix security update

Postfix is a Mail Transport Agent MTA. Security Fixes: Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.CVE-2026-43964...

GHSA-2F25-PFQ3-C7H8

creationtimestamp| type| source ---|---|--- 2026-05-09 06:10:29+00:00| seen| https://gist.github.com/alon710/5630cef7c3595002259238662d69e7b6...

CVE-2026-42174

creationtimestamp| type| source ---|---|--- 2026-05-09 05:02:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfhpvrzss2k...

CVE-2026-8207

creationtimestamp| type| source ---|---|--- 2026-05-09 04:52:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfh6k6yu52c...

GHSA-G8R3-5HWF-QP96 epa4all-client has a VAU Signature bypass

Impact In SignedPublicKeysTrustValidatorImpl.isTrusted, the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify. The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually...