Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Oracle Content Server - Cross-Site Scripting

Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site. id: CVE-2017-100...

GO-2026-5826 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context in github.com/nezhahq/nezha

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2026-55255

Summary of technical details : CVE-2026-55255 is an IDOR in Langflow prior to version 1.9.1 where an authenticated user could trigger a victim’s flow by supplying the victim’s flow UUID to the /api/v1/responses endpoint. The root cause is in get_flow_by_id_or_endpoint_name(), which could load a F...

Adobe Bridge heap buffer overflow vulnerability (CNVD-2026-17717)

Adobe Bridge is a file viewer from the American company Audobee Adobe. Adobe Bridge suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

EUVD-2026-9504

Vaultwarden has Unauthorized Access via Partial Update API on Another User’s Cipher...

CVE-2025-55179

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...

EUVD-2025-38272

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

CVE-2025-54968

The advisory concerns BAE Systems SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication, enabling remote users to submit jobs or local users to submit jobs that execute with another user's permissions. This behavior is documented across multiple sources (NVD/RedHat/C...

EUVD-2018-0774

Malware in sbrugna...

EUVD-2019-13942

Malware in sbrugna...

EUVD-2017-2475

Malware in sbrugna...

EUVD-2016-5878

Malware in sbrugna...

EUVD-2017-11340

Malware in sbrugna...

EUVD-2018-0272

Malware in sbrugna...

EUVD-2014-0515

Malware in sbrugna...

EUVD-2023-48108

Malicious code in bioql PyPI...

CVE-2025-0076

In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-0087

In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

I

Description Improper authorization controls in the conversation sharing feature make it possible to access other user's conversations given a known conversation ID. The exploitability is limited by the fact that UUIDv4 conversation IDs are generated on the server side and are practically impossib...