NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-49259
## Summary A stored cross-site scripting (XSS) vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-
2026-07-14 归档
今日共收录 1138 条安全情报，包含 379 个 CVE，396 篇安全通告，以及 80 篇研究论文。
← 返回归档列表NukeViet: Unauthenticated Reflected XSS in Comment Module
CVE-2026-48118
## Summary Reflected XSS in the Comment module via the `status_comment` URL parameter. The parameter accepts attacker-c
DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
CVE-2026-45579
### Summary An remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input th
Decidim: Push subscriptions can be abused for server-side requests
CVE-2026-45573
## Description The push-subscription endpoint stores an attacker-controlled delivery URL, and the notification send pat
Decidim: HTML content blocks allow stored script execution
CVE-2026-45572
## Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an
Decidim: CSV census record endpoints improper authorization
CVE-2026-45415
## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description
Decidim: JWT-backed authentication can be replayed across organizations
CVE-2026-45414
## Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL `parti
Decidim: Verification documents can be downloaded through reusable links
CVE-2026-45378
## Description Scanned identity-document images provided by participants and shown in the verification admin workflow a
Firewall for AI
Akamai 推出了名为 'Firewall for AI' 的安全产品，旨在保护人工智能应用免受分布式拒绝服务（DDoS）攻击和僵尸网络威胁。该产品利用 Akamai 的全球边缘网络和智能流量分析能力，识别并阻断针对 AI 模型推理端点、
US and allies warn of Russian critical infrastructure attacks
Cybersecurity agencies from the United States and eight other countries have issued a joint warning that Russian state h
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
Google and Microsoft have pulled ModHeader, a popular header-editing extension with roughly 1.6 million installs across
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be t
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud
Sign Up for Free Cloud Tier
Sign Up for Free Cloud Tier
iOS 26.4.2 and iPadOS 26.4.2
iOS 26.4.2 and iPadOS 26.4.2
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.7 and iPadOS 18.7.7
iOS 18.7.7 and iPadOS 18.7.7
iOS 26.4 and iPadOS 26.4
iOS 26.4 and iPadOS 26.4
Background Security Improvements for iOS, iPadOS, and macOS
Background Security Improvements for iOS, iPadOS, and macOS