CVE-2026-1276

IBM QRadar SIEM is vulnerable to cross-site scripting (CVE-2026-1276). The issue affects QRadar SIEM versions 7.5.0 up to 7.5.0 UP14, where an authenticated user can embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The linked connec...

CVE-2026-1276 IBM QRadar SIEM Cross-Site Scripting

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2026-1276

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2026-26244

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-67112

The Small Cell Sercomm SCE4255W (FreedomFi Englewood) broadband gateway is vulnerable to a security flaw due to the use of a hard-coded AES-256-CBC key within its configuration backup/restore implementation. This vulnerability exists in firmware versions before DG3934v3@2308041842 . Remote authen...

KLA90959 Multiple vulnerabilities in Microsoft Apps

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A tampering vulnerability in Microsoft Bing can be exploite...

Apache Airflow Information Disclosure Vulnerability (CNVD-2026-15158)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow has an information disclosure vulnerability that stems...

CVE-2026-32632

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

MAL-2026-1590 Malicious code in @cbreone/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7e204888ba2b9573e474d804f28f51173684bb25f640615a9eaae217c5e1a45 The package @cbreone/core-ui was found to contain malicious code...

EUVD-2026-12785

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...

CVE-2026-22316

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...

CVE-2026-22316

The CVE-2026-22316 entry describes a remote-authenticated (webUI user) vulnerability where sending a POST request that sets the TFTP Filename triggers a stack-based buffer overflow, resulting in a DoS condition. According to sources, this is a network-accessible issue with low privileges required...

CVE-2026-22316 Buffer Overflow using TFTP Filename

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...

PT-2026-26032

CVE-2026-22316 A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting … https://t.co/Wf4fwn1VYa...

Blending Chat with Rich UIs with Spring AI and MCP Apps

The way humans typically interact with AI is via a chat-style interface such as ChatGPT or Claude Desktop. In fact, the ability to converse with an AI in natural language is perhaps one of the most amazing things about this technology. It lets humans talk to computers in human terms, rather than...

CVE-2026-28563

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to...

PT-2026-29103

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.4 Description Nginx UI, a web user interface for the Nginx web server, contains a flaw in its backup restore mechanism. Prior to version 2.3.4, attackers can manipulate encrypted backup archives and inject...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow has an information disclosure vulnerability that stems...

The vulnerability of Flowise Cloud, a software platform for creating user interfaces based on Language Models (LLMs), allows a hacker to gain access to confidential information.

The vulnerability of Flowise Cloud, a software platform for creating user interfaces based on Language Models LLMs, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to confidential information...

EUVD-2025-208745

Cross Site scripting vulnerability XSS in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts...