CVE-2026-5782

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Loglama.net TurkHotspot due to the improper neutralization of input during web page generation. This vulnerability allows an attacker to execute scripts in a victim's browser. The issue affects versions of TurkHotspot through 2026-10-...

CVE-2026-104610

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138enxpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed...

web-security-labs

🌐 Sasidhar C — Web Security Labs Hands-on web security labs a...

CVE-2026-102798 WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0...

EUVD-2026-91589

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0...

Uncaught Exception

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Uncaught Exception in the web server, which registers no error listener on a socket after it has been...

EUVD-2026-91570

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138enxpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed...

CVE-2026-104610 Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138enxpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed...

CVE-2026-104610 Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138enxpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed...

CVE-2026-104610

A stack-based buffer overflow vulnerability exists in the Boa Web Server component of Tenda HG7, HG9, and HG10 (300001138_en_xpon) devices. The issue is triggered by manipulating the Ethtype argument within the boaGetVar function of the /boaform/formLoopBack file. This vulnerability can be exploi...

EUVD-2026-91482

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

Malicious Package

Overview @fazzcodestudio/wa-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Updated python-urwid & python-wcwidth packages fixes a security vulnerability

Insecure PRNG and Information Exposure in urwid Web Display Backend...

MGASA-2026-0466 Updated python-urwid & python-wcwidth packages fixes a security vulnerability

Insecure PRNG and Information Exposure in urwid Web Display Backend...

CVE-2026-101916 vulnerabilities

Vulnerabilities for packages: opentelemetry-auto-instrumentations-node, dotstatsuite-supercore, homepage, langfuse, cadence-web, pulumi, zitadel, azurite, langfuse-fips, kibana, librechat...

GHSA-M9GG-HP2V-232J vulnerabilities

Vulnerabilities for packages: opentelemetry-auto-instrumentations-node, dotstatsuite-supercore, homepage, langfuse, cadence-web, pulumi, zitadel, azurite, langfuse-fips, kibana, librechat...

GHSA-F596-WHHP-79R4 vulnerabilities

Vulnerabilities for packages: opentelemetry-auto-instrumentations-node, dotstatsuite-supercore, homepage, langfuse, cadence-web, pulumi, zitadel, azurite, langfuse-fips, kibana, librechat...

CVE-2026-101915 vulnerabilities

Vulnerabilities for packages: opentelemetry-auto-instrumentations-node, dotstatsuite-supercore, homepage, langfuse, cadence-web, pulumi, zitadel, azurite, langfuse-fips, kibana, librechat...

Path traversal vulnerability in FUJIFILM Business Innovation and Sharp MFPs (multifunction printers)

Overview Multiple MFPs multifunction printers provided by FUJIFILM Business Innovation Corp. and Sharp Corporation contain a path traversal vulnerability. Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 - CVE-2026-78249 FUJIFILM Business Innovation Corp. report...

EUVD-2026-91067

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting XSS. This issue affects CAPEC-63: before 3.0b63...