115144 matches found
CVE-2026-37470
An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components...
@airalogy/airalogy-engine (>=0.0.1, <=0.0.5) potentially affected by CVE-2026-46695 via @boxlite-ai/boxlite (0.8.2)
@boxlite-ai/boxlite NPM version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on @boxlite-ai/boxlite and may be impacted: - @airalogy/airalogy-engine =0.0.1, =0.0.5 Source cves: CVE-2026-46695 Source advisory: OSV:GHSA-G6WW-W5J2-R7X3...
CVE-2026-4093 Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A token display templates: When the Token module is enabled and token display templates are configured, attacker-controlled token output e.g., term description is rendered...
@microsoft/applicationinsights-analytics-js (>=3.0.0-beta.2208-16, <=3.0.0-beta.2302-03), @microsoft/applicationinsights-channel-js (>=3.0.0-beta.2208-16, <=3.0.0-beta.2302-03) +11 more potentially affected by CVE-2026-46681 via @nevware21/ts-utils (>=0.3.5, <=0.7.3)
@nevware21/ts-utils NPM version =0.3.5, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =1.0.0, =1.1.2...
NPM: JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
NPM: JavaScript Cookie: Per-instance prototype hijack in assign enables cookie-attribute injection vulnerability discovered by ? in WordPress Npm js-cookie versions = 3.0.5...
CVE-2026-8240
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information. The Concrete CMS security te...
CVE-2026-6826 Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/fID with any file ID and receive a list of every page that references that file,...
CVE-2026-8421 Concrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCE
Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the installpackage method of concrete/controllers/singlepage/dashboard/extend/install.php. An attacker who can cause an authenticated administrator to visit a crafted page, and who has placed or caused a package to be present under...
EUVD-2026-31337
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepareremoteupgrade/. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade method to...
@alexaegis/svelte-config (>=0.15.0, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +6 more potentially affected by unknown CVE via @sveltejs/kit (>=2.39.1, <=2.59.1)
@sveltejs/kit NPM version =2.39.1, =0.15.0, =1.2.0, =0.0.137, =0.1.0, =2.0.0, =5.0.0-alpha.1, =0.3.2, =1.7.0, =1.15.1 Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-16796279...
LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
Summary lmdeploy hardcodes trustremotecode=True in multiple HuggingFace model-loading call sites. The affected code paths are in: text lmdeploy/archs.py lmdeploy/utils.py The vulnerable call sites pass trustremotecode=True into HuggingFace Transformers APIs such as AutoConfig.frompretrained,...
DoS (Denial of Service) nth-check Dependency in Jira Software Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 9.15.2, 9.16.0, 9.17.0, 10.0.1, and 10.3.20 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows a...
CVE-2026-39531
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0...
SUSE CVE-2026-9115
Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...
Security Bulletin: Storage Virtualize Ansible Collection is affected by a vulnerability in the cryptography package
Summary Storage Virtualize Ansible Collection uses the cryptography package to provide common cryptographic algorithms. Version cryptography-46.0.5 package is vulnerable to CVE-2026-39892. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...
Exploit for CVE-2026-4885
CVE-2026-4885 Piotnet Addons for Elementor Pro Note: The...
lab-xss
XSS Vulnerability Lab Aplikasi web statis untuk simulasi dan...
CVE-2026-44073
Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid, which may allow a remote authenticated attacker to retain elevated privileges under error conditions...
CVE-2026-44063
An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input...