1110 matches found
modoboa 2.0.4 - Admin TakeOver
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...
Apache Tomcat Examples Web Application - Cross-Site Scripting
Apache Tomcat 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22, and 10.1.0-M1 to 10.1.0-M16 contain a reflected cross-site scripting caused by displaying unfiltered user data in the Form authentication example, letting attackers execute scripts in victim browsers, exploit requires attacke...
Malicious code in @veertly/web-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 356a8a00db1082e33357c6fa0bd625070977f72964236e992e1be94dcd419764 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2026-53426
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...
CVE-2026-9190
Progress MarkLogic Server versions before 11.3.6 and 12.0.3 contain an HTTP request smuggling flaw in the HTTP App Server. A crafted request with both Content-Length and Transfer-Encoding headers can cause the reverse proxy and MarkLogic Server to misinterpret request boundaries, enabling an atta...
CVE-2026-16970 DFIR-IRIS Insufficient Logout Implementation
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...
CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...
CVE-2026-18362
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...
CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-18361
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
CVE-2026-18360
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
DEBIAN-CVE-2026-17872
Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-17872
Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...
EUVD-2026-50621
Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-14122
An insufficient validation of untrusted input flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513824891...
GHSA-8PPF-4F7H-5PPJ vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, mitmproxy, kubeflow-pipelines-visualization-server, superset, k8s-sidecar, kubeflow-jupyter-web-app, kubeflow-pipelines, mlflow, py3-cassandra-medusa, datadog-agent, kserve, airflow...
CVE-2026-59886 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, mitmproxy, kubeflow-pipelines-visualization-server, superset, k8s-sidecar, kubeflow-jupyter-web-app, kubeflow-pipelines, mlflow, py3-cassandra-medusa, datadog-agent, kserve, airflow...
CVE-2026-59890 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, superset, pypy-3.10, kubeflow-jupyter-web-app, mlflow, py3-pipenv, httpie, datadog-agent, py3-setuptools, airflow, kubeflow-katib...