Tagged “cve.org”
CVEs tagged cve.org, newest first.
49927 CVEsRSS
CVE-2026-113383Medium· 4.3Optimal IdM OptimalCloud Login cross site scripting
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of…
CVE-2026-113358High· 7.5PoCLavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbi…
CVE-2026-113356High· 7.5PoCDokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concur…
CVE-2026-113355Medium· 4.8Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations …
CVE-2026-113384Medium· 4.3Optimal IdM OptimalCloud social redirect
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The v…
CVE-2026-14933High· 8.6Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute …
CVE-2026-113583Medium· 6.1Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag wh…
CVE-2026-9589Critical· 9.3Unblu Spark Authorization Bypass in Configuration Cascade Operations
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and ch…
CVE-2026-113385Medium· 5.3PoCLeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android…
CVE-2026-113496Medium· 5.0Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a…
CVE-2026-113495Medium· 5.0Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a…
CVE-2026-113351Medium· 5.9libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the …
CVE-2026-105949High· 8.8Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(…
CVE-2026-18205Medium· 6.1XSS in Ticimax Informatics' Ticimax E-Commerce Platform
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS. This issue affects Ticimax E-Commerce Platform…
CVE-2026-105312Critical· 9.9Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBindin…
CVE-2026-105311High· 7.7Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with …
CVE-2026-113388Medium· 4.3PoCopensource-socialnetwork Cache Settings dynamic.php input code injection
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argume…
CVE-2026-93878Medium· 6.4DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it …
CVE-2026-113407High· 8.8YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
CVE-2026-113405High· 8.8YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
CVE-2026-113403Medium· 6.5ArmorX Global Technology｜ArmorX Spam - Command Injection
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.
CVE-2026-112177High· 7.3Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure ins…
CVE-2026-111090High· 7.8Improper Signature Verification of Firmware Update Files
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automati…
CVE-2026-113406High· 8.8YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
CVE-2024-2323Medium· 4.8Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user accoun…
CVE-2026-96902Medium· 5.3Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such …
CVE-2026-113404High· 8.8Uniong｜WebITR - Insecure Deserialization
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
CVE-2026-96903Medium· 4.3Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users'…
CVE-2026-113402Medium· 6.5ArmorX Global Technology｜ArmorX Spam - Local File Inclusion
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
CVE-2026-112148Medium· 5.1A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint…
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint…