2908 matches found
CVE-2026-102980
The open-source project management tool Plane is vulnerable to a Cross-Project Page Content Disclosure prior to version 1.4.0 . The root cause is located in apps/api/plane/app/views/page/version.py, where PageVersionEndpoint fails to scope lookups by the project_id from the URL. Because ProjectPa...
CVE-2026-102980 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...
Views Component DoS
The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...
Views Component DoS
The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...
EUVD-2026-97970
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where...
CVE-2026-109392
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...
CVE-2026-109392
Pimcore versions through 2026.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw within the ExternalImage field. The root cause is the storage of unescaped URLs , which allows authenticated backend users with data object edit permissions to inject attribute-breaking payloads. These pa...
CVE-2026-109392 Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...
EUVD-2026-97490
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...
voltron
Voltron Voltron es un kit de herramientas extensible para la interfaz de usuario de depuradores, escrito en Python. Su objetivo es mejorar la experiencia del usuario de varios depuradores LLDB, GDB, VDB y WinDbg permitiendo la conexión de vistas de utilidad que pueden recuperar y mostrar datos de...
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
Summary The task-collection endpoint GET /api/v1/projects/project/views/view/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the view is...
DRUPAL-CONTRIB-2026-205
This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability...
Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205
This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability...
PT-2026-107508
Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description Five gym management views contain a flawed gym-scope guard that fails when both compared operands are None. An authenticated trainer possessing gym.gym trainer and gym.add adminusernote permissions who is...
EUVD-2026-93913
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...
CVE-2026-95106
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...
CVE-2026-40807
Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...
CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...
CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...