122694 matches found
SUSE SLES16 Security Update : go1.25-openssl (SUSE-SU-2026:22638-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22638-1 advisory. This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo:...
CVE-2026-11324: Improper Neutralization of Input During Web Page Generation
The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-62386: Use of GET Request Method With Sensitive Query Strings
The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...
PT-2026-60844
Name of the Vulnerable Software and Affected Versions IBM Engineering AI Hub versions 1.0.0 through 1.2.0 Description Improper validation of user-supplied URLs allows a remote attacker to redirect users to malicious websites. Recommendations At the moment, there is no information about a newer...
PT-2026-60895
Name of the Vulnerable Software and Affected Versions CloudTAK versions prior to 13.22.1 Description CloudTAK contains a server-side request forgery SSRF flaw in the authenticated PUT /api/basemap endpoint. The importBasemapURL function in api/routes/basemap.ts uses fetchurl to retrieve content...
CVE-2026-15093: URL Redirection to Untrusted Site
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs...
PT-2026-60749
Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application passes sensitive data through URL parameters during normal usage via the GET method. This practice can lead to the exposure of sensitive information as it may be...
CVE-2024-23567: Guessable CAPTCHA
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local...
CVE-2026-62226: Server-Side Request Forgery (SSRF)
OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...
GHSA-X8MG-6R4P-87PF
creationtimestamp| type| source ---|---|--- 2026-07-16 23:48:09+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59 2026-07-17 00:00:25+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59...
CVE-2026-55629
creationtimestamp| type| source ---|---|--- 2026-07-16 22:51:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsd5djqhg2m 2026-08-25 20:35:15+00:00| published-proof-of-concept| https://github.com/avwo/whistle/security/advisories/GHSA-3vfr-4gwf-qxfp...
EUVD-2026-45058
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...
CVE-2026-45368
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...
CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...
EUVD-2026-45009
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...
EUVD-2026-45010
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...
EUVD-2026-45008
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...
CVE-2026-53536
creationtimestamp| type| source ---|---|--- 2026-07-16 20:35:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqs3lbupgq2i...