CVE-2026-31019

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code...

CVE-2026-31019: Improper Neutralization of Special Elements used in an OS Command

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code...

CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

WordPress Website LLMs.txt plugin <= 8.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Kazuma Matsumoto - GMO Cybersecurity by IERAE, Inc. in WordPress Plugin Website LLMs.txt versions = 8.2.6...

The vulnerability of the software for coordinating the operation of security systems and for managing real-time incident responses in Fortinet FortiSOAR lies in the lack of protection for website structures. This allows attackers to execute XSS attacks.

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing incident responses in real-time is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a...

The vulnerability of the sub_401F80() function in the microprogramming software for Wavlink WL-WN579A3 allows attackers to carry out XSS attacks.

The vulnerability of the sub401F80 function in the microprogramming software for Wavlink WL-WN579A3 relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a remote attacker to perform XSS attacks...

The vulnerability of the Jenkins automation server relates to the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Jenkins automation server relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the lack of protection for website structures, allows attackers to execute arbitrary commands or code.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands or code...

python-vulnerability-scanner

Python Web Vulnerability Scanner This project is a simple Pyt...

A fake Slack download is giving attackers a hidden desktop on your machine

A trojanized Slack download from a typosquatting website is giving attackers something most users wouldn’t even know to look for: a hidden desktop running on their machine. The installer looks legitimate and even launches a working copy of Slack. But in the background, it can create an invisible...

The vulnerability of the platform for creating, publishing, and reproducing digital advertising within Adobe Experience Manager (AEM) Screens lies in the lack of protective measures for website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM Screens platform, which is used for creating, publishing, and reproducing digital advertisements, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute...

The vulnerability of the platform for creating, publishing, and reproducing digital advertising on Adobe Experience Manager (AEM) Screens lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM Screens platform, which is used for creating, publishing, and reproducing digital advertisements, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute...

The vulnerability of Windows Admin Center, related to the lack of measures taken to protect the website structure, allows attackers to perform spear-phishing attacks.

The vulnerability of the Windows Admin Center management tool is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server programs lies in the lack of security measures for website structures, allowing attackers to perform spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform spear-phishin...

The vulnerability of the platform for creating, publishing, and reproducing digital advertising on Adobe Experience Manager (AEM) Screens lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM Screens platform, which is used for creating, publishing, and reproducing digital advertisements, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute...

The vulnerability of Adobe Connect and Adobe Connect Desktop Application’s messaging services lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of Adobe Connect and Adobe Connect Desktop Application messaging services is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-40316: Improper Control of Generation of Code

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pullrequesttarget trigger to run wit...

Permissive Cross-domain Policy with Untrusted Domains

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the allowOrigin function. An attacker can access sensitive user data and perform unauthorized actions by...

CVE-2026-26179

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:07:10+00:00| seen| Telegram/rQ4ykS-UeIVVliGXcS6ubw63hybmYbI00J0TD7zD91pBCs 2026-04-14 20:07:16+00:00| seen|...

CVE-2026-21741

An URL Redirection to Untrusted Site 'Open Redirect' vulnerability CWE-601 vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary...