CVE-2026-41965

Technical details (affected product, components, exploit steps, versions, or remediation) are not publicly provided in the supplied documents. Monitor for updates from official sources.

CVE-2026-41965

Use-After-Free UAF vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41964

Technical details about CVE-2026-41964 are not publicly available in the provided documents. Monitor for updates from Huawei bulletins and CVE records to obtain affected products, impact specifics, and remediation.

CVE-2026-41964

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41964

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

BlueNoteMKVI PHP Timeclock 跨站脚本漏洞

BlueNoteMKVI PHP Timeclock is an employee attendance and working hours recording system developed by BlueNoteMKVI company, based on PHP and MySQL. Version 1.04 of PHP Timeclock contains a cross-site scripting vulnerability. This vulnerability stems from multiple cross-site scripting issues,...

PT-2026-41286

Use-After-Free UAF vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI that is open source. Versions of Open WebUI prior to 0.8.0 had a cross-site scripting vulnerability. This vulnerability stemmed from the insecure preview of Excel file attachments. The specially crafted XLSX file paylo...

GHSA-5QRQ-9645-G5G2 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summary fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the...

DVWA-Web-Vulnerability-Project

...

CVE-2025-27852

The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a reflected cross site scripting XSS attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is...

CVE-2026-43875 WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oauth2Success.php?user=&pass= where is the victim's stored password hash md5hash"whirlpool", sha1password read directly fro...

-Advanced-Web-Vulnerability-Scanner

No d...

EUVD-2021-34799

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by injecting malicious code into the satcode parameter. Attackers can authenticate, submit a POST request to...

CVE-2026-8126 SourceCodester Comment System post_comment.php sql injection

A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file postcomment.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used...

CVE-2023-42345

Affected product: Alkacon OpenCms before 16. Vulnerability: Cross Site Scripting via updateModelGroups.jsp. Root cause not detailed in the provided documents. Impact aligned with CVSS: 6.1 (Medium) with user interaction required. Exploitation status not provided in the sources. No remediation/pat...

PT-2026-39139

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting XSS vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been...

Django: Django: Denial of Service via crafted HTML inputs

A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the django.utils.text.Truncator.chars and Truncator.words methods when html=True, or through the truncatecharshtml and truncatewordshtml...

CVE-2026-6002

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross-Site Scripting XSS. This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2...

CVE-2026-6002

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross-Site Scripting XSS. This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2...