CVE-2026-1207

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField only implemented on PostGIS allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluate...

WordPress plugin ThirstyAffiliates 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

CVE-2025-13984

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

CVE-2026-24410 iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic. This occurs when user-controllable input is unsafely incorporated into I...

PT-2026-2623

CVE-2025-8090 A null pointer dereference vulnerability in the MsgRegisterEvent system call of the QNX Neutrino Kernel in QNX SDP 7.1 and 7.0, and QNX OS for Safety 2.2, 2.1 and 2.0… https://t.co/avEstN8B4y...

CVE-2018-4843

A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 All versions V7.0.3, SIMATIC S7-400 CPU 414F-3 PN/DP V7 All versions V7.0.3, SIMATIC S7-400 CPU 416-3 PN/DP V7 All versions V7.0.3, SIMATIC S7-400 CPU 416F-3 PN/DP V7 All versions V7.0.3, SIMATIC CP 343-1 incl. SIPLUS varian...

PT-2026-2230

Name of the Vulnerable Software and Affected Versions Angular versions prior to 19.2.18 Angular versions prior to 20.3.16 Angular versions prior to 21.0.7 Angular version 21.1.0-rc.0 Description Angular is a development platform for building mobile and desktop web applications using...

EUVD-2025-206246

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges e.g....

PT-2025-52582

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.9 Description The Image Photo Gallery Final Tiles Grid plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output...

Versa SASE Client for Windows 安全漏洞

Versa SASE Client for Windows is a secure networking client from Versa USA. A security vulnerability exists in Versa SASE Client for Windows versions 7.8.7 through 7.9.4, which stems from a local elevation of privilege vulnerability in the Audit Log Export feature that could lead to arbitrary...

PT-2025-52417

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 25.12.15491.7 M-Files Server versions 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5 Description An information disclosure issue exists in M-Files Server that could allow an authenticated attacker using M-Files W...

CVE-2025-13969 Reviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute

The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the reviews-slider shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2025-13904

CVE-2025-13904 (WPGancio plugin for WordPress) is a Stored Cross-Site Scripting (SSS) vulnerability in the gancio-event shortcode. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes, affecting all versions up to and including 1.12. Exploitation re...

CVE-2025-64602 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-62102

Cross-Site Request Forgery CSRF vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through = 3.5.1...

Okta Java Management SDK 安全漏洞

Okta Java Management SDK is an open source Java development toolkit from Okta, Inc. A security vulnerability exists in Okta Java Management SDK versions 21.0.0 through 24.0.0, which stems from improper thread cleanup and could result in a denial of service...

CVE-2025-54353

CVE-2025-54353 describes an XSS vulnerability in Fortinet FortiSandbox affecting versions 4.0 all, 4.2, 4.4.0–4.4.7, and 5.0.0–5.0.2, due to improper neutralization of input during web page generation. The issue may allow an attacker to craft HTTP requests that trigger cross-site scripting. Conne...

GHSA-MHPG-HPJ5-73R2 Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before...

Kirby 跨站脚本漏洞

Kirby is a file-based content management system CMS from Kirby open source. A cross-site scripting vulnerability exists in Kirby versions 5.0.0 through 5.1.3, which stems from malicious string modification and content field manipulation that could lead to malicious code execution...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A security vulnerability in Fortinet FortiWe...