CVE-2026-48952 Joomla! Core - [20260706] - XSS in com_installer

Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...

EUVD-2026-42070

Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...

CVE-2026-48952

Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...

CVE-2026-48952

Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...

CVE-2026-48952 Joomla! Core - [20260706] - XSS in com_installer

Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...

CVE-2026-48950

CVE-2026-48950 affects Joomla! Core via the file management view in com_templates. The root cause is lack of escaping, enabling an XSS vulnerability. Multiple sources (NVD, CVE lists, and Joomla security advisory) confirm an XSS in the core component with the vulnerable entry labeled for core/com...

CVE-2026-48950

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

EUVD-2026-42067

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

CVE-2026-48950 Joomla! Core - [20260704] - XSS in com_templates

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

CVE-2026-48950 Joomla! Core - [20260704] - XSS in com_templates

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in DataView. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-50193 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

Chainlit contains an authorization bypass vulnerability

Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product...

brew-view (>=2.4.0, <=2.4.21), fast-explain (>=0.0.49, <=0.0.91) +6 more potentially affected by CVE-2025-47287 via tornado (5.1.0)

tornado PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - brew-view =2.4.0, =0.0.49, =0.9.0.2, =0.1.2, =0.10.2, =0.5.23, =0.6.0 Source cves: CVE-2025-47287 Source advisory: OSV:PYSEC-2026-1974...

django-manifold (>=1.0.0, <=1.3.0), django-view-breadcrumbs (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-48588 via django (2.0.2)

django PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-manifold =1.0.0, =0.0.1, =0.0.3 - mapistar 0.1.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-manifold (>=1.0.0, <=1.3.0), django-view-breadcrumbs (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-53878 via django (2.0.2)

django PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-manifold =1.0.0, =0.0.1, =0.0.3 - mapistar 0.1.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

django-manifold (>=1.0.0, <=1.3.0), django-view-breadcrumbs (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-53877 via django (2.0.2)

django PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-manifold =1.0.0, =0.0.1, =0.0.3 - mapistar 0.1.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

CKAN has Cross-site Scripting vector in the Datatables view plugin

The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. ImpactSites running CKAN = 2.7.0 with the datatablesview plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to...

PYSEC-2026-1253 CKAN has Cross-site Scripting vector in the Datatables view plugin

The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Impact Sites running CKAN = 2.7.0 with the datatablesview plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to...

MobSF vulnerable to Open Redirect in Login Redirect

ImpactWhat kind of vulnerability is it? Who is impacted?An open redirect vulnerability exist in MobSF authentication view. PoC1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.2. Enter credentials and press "Sign In".3. You will be redirected to afine.comUsers who are not...

apache-airflow DAG source authorization bypass exposes co-located DAG source

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...