472967 matches found
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475
IDURAR ERP CRM, versions through 4.1.1 , is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the application's failure to sanitize SVG files during the upload process. Authenticated users can exploit this by uploading JavaScript-laden SVGs via the profile update or settin...
CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...
CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...
CVE-2026-104873
The LangGraph Python SDK is vulnerable to an authorization bypass in versions 0.1.45 through 0.4.3 . The root cause is that resource-scoped authorization decorators (@auth.on.threads , @auth.on.assistants , and @auth.on.crons ) ignore the actions argument, registering handlers for every action on...
CLSA-2026-1790963665 TuxCare security update for js-yaml (5 CVEs)
TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.13.1-tuxcare.1...
CLSA-2026-1790963499 TuxCare security update for tar-fs (3 CVEs)
TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 2.1.1-tuxcare.1...
CLSA-2026-1790957410 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.2.7-tuxcare.6...
CLSA-2026-1790947292 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.10...
CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
EUVD-2026-91456
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
CVE-2026-104445
Versions of YesWiki prior to 4.6.7 are susceptible to an authentication bypass vulnerability within the ActivityPub inbox . The root cause is a failure to bind the verified HTTP signature signer to the activity actor. This allows unauthenticated attackers possessing any ActivityPub keypair to sen...
CVE-2026-59667
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...
CLSA-2026-1790937671 TuxCare security update for ip-address (1 CVE)
TuxCare rebuilt ip-address to address 1 CVE. Fixed in 7.1.0-tuxcare.5...
CVE-2026-86326
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...
CVE-2026-86326
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...