112737 matches found
PT-2026-32399
ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For...
Important: python3.11
Issue Overview: The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open. CVE-2026-4519 Affected Packages:...
Amazon Linux 2023 : yq (ALAS2023-2026-1582)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1582 advisory. The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially...
How to create an External Client App to Connect Veeam Backup for Salesforce
Purpose This article documents how to create an External Client App ECA in Salesforce to integrate with Veeam Backup for Salesforce via Salesforce API. An ECA with proper permissions is required for Veeam Backup for Salesforce to integrate with Salesforce API using the OAuth 2.0 protocol. Solutio...
The vulnerability of the Omnibox address bar in the Google Chrome browser on iOS operating systems allows a hacker to replace the content in the URL bar.
The vulnerability of the Omnibox address bar in Google Chrome browsers on iOS operating systems is related to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to replace the content in the URL bar using a specially created domain name...
CVE-2026-40394
creationtimestamp| type| source ---|---|--- 2026-04-12 22:02:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjde5fz7lw2t...
CVE-2026-6141
creationtimestamp| type| source ---|---|--- 2026-04-12 16:16:35+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-6141 2026-04-13 02:53:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjduepjwot23...
CVE-2019-25689
creationtimestamp| type| source ---|---|--- 2026-04-12 14:32:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjckxhm7h72z 2026-06-07 18:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mnpr3kvhh32m...
CVE-2019-25695
creationtimestamp| type| source ---|---|--- 2026-04-12 14:25:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjckm4ahhg2r...
CVE-2026-6119
creationtimestamp| type| source ---|---|--- 2026-04-12 06:13:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjbp33qf5d23...
CVE-2026-6111
CVE-2026-6111 affects FoundationAgents MetaGPT (up to at least 0.8.1/0.8.2) and targets the function decode_image in metagpt/utils/common.py . Manipulating the argument img_url_or_b64 enables a server-side request forgery (SSRF) that can be triggered remotely. The CVSS data indicates network acce...
VulnCheck KEV: CVE-2025-22952
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...
python: Python: Command-line option injection in webbrowser.open() via crafted URLs
A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...
Exploit for SQL Injection in Churchcrm
CVE-2025-68400: ChurchCRM vulnerable to time-based blind SQL I...
CVE-2026-40263
creationtimestamp| type| source ---|---|--- 2026-04-11 15:12:15+00:00| published-proof-of-concept| https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp 2026-04-17 03:28:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjny7g4tdw2k...
OESA-2026-1851 golang security update
. Security Fixes: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable...
CVE-2026-5809 wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topicadd and topicedit action handlers accept arbitrary user-supplied data arrays from $REQUEST and store them as postmeta without...
CVE-2025-6986
creationtimestamp| type| source ---|---|--- 2026-04-11 06:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mj77kqm4jb2u...