15583 matches found
CVE-2026-16969 DFIR-IRIS Stored XSS in Assets
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
CVE-2026-16969
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
[SECURITY] Fedora 43 Update: nginx-mod-naxsi-1.6-21.fc43
naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...
CVE-2026-16970: Insufficient Session Expiration
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...
PT-2026-66450
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...
PT-2026-66446
Name of the Vulnerable Software and Affected Versions IRIS web application version 2.4.26 Description The logout functionality is ineffective, allowing stolen session cookies to be misused for an extended period. Recommendations At the moment, there is no information about a newer version that...
CVE-2026-18362: Allocation of Resources Without Limits or Throttling
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...
PT-2026-66449
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
PT-2026-66447
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
PT-2026-66445
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
PT-2026-66510
Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0 Description A Regular Expression Denial of Service ReDoS occurs in the sql parse.py component due to the SQL REGEX used for parsing SQL statements in the sqlparse library integration. The regular...
PT-2026-66448
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
CVE-2026-41939
Summary: CVE-2026-41939 affects Care Everywhere Gateway 14.3.10, where a hard-coded credential flaw in the bundled WildFly 8.2.0.Final management interface enables unauthenticated remote access to the WildFly admin console (port 20990) with default credentials. This allows deployment of a malicio...
CVE-2026-56407
An integer overflow exists in libexpat's doProlog function due to improper handling of entity value lengths. A local attacker could exploit this to execute arbitrary code or access sensitive system data. Mitigation To prevent exploitation explicitly disable all internal and external XML entity...
CVE-2025-67408
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /saveuser.php via the parameter status...
CVE-2025-67405
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...
CVE-2026-66299
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...
CVE-2026-66299 Apache Tomcat: DoS via WebSocket chat example
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...
CVE-2026-59688
The CVE-2026-59688 entry describes an OS Command Injection in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. An authenticated user with high privileges can execute arbitrary OS commands on the affected appliance via the backup restore functi...