1137614 matches found
EUVD-2026-102148
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...
CVE-2026-111096
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...
CVE-2026-111095
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...
EUVD-2026-102149
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...
CVE-2026-111095
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...
CVE-2026-111095
JetBrains TeamCity versions before 2026.2 , 2026.1.4 , and 2025.11.8 are vulnerable to a stored Cross-Site Scripting (XSS) flaw. The vulnerability exists within the classic project overview component, where improper neutralization of input during web page generation allows for script execution. T...
EUVD-2026-102136
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...
CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...
CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...
CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...
CVE-2026-58390
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...
CVE-2026-58390
Prior to version 26.1.11 , OPNsense is vulnerable to a Stored XSS leading to root RCE . The flaw exists in the OpenVPN connection-status dashboard widget (specifically src/opnsense/www/js/widgets/OpenVPNClients.js) and the connection-status view , where the common_name of an OpenVPN client is ins...
EUVD-2026-102135
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...
CVE-2026-58394
The OPNsense firewall and routing platform is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 26.1.11 . The vulnerability exists because src/www/system_advanced_admin.php fails to include the $a_cert array in the legacy_html_escape_form_data() function before rendering certif...
CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...
CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...
CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...
CVE-2026-58394
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...
CVE-2026-58392
The OPNsense firewall and routing platform (prior to version 26.1.11 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the NTP GPS page. The root cause is that the src/www/services_ntpd_gps.php component applies legacy_html_escape_form_data() to a base64-encoded initcmd value but sub...
EUVD-2026-102132
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...