Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
CVE-2026-46609
### Impact Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confi
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
CVE-2026-46556
###Summary A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
CVE-2026-46552
### Summary Shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only th
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
CVE-2026-46551
### Summary The `uploadViaURL` path in the v1/v2 attachment API did not enforce `NC_ATTACHMENT_FIELD_SIZE` against the
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
CVE-2026-46550
### Summary The refresh-token cookie was set with `httpOnly: true` but missing both the `secure` flag and the `sameSite
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
CVE-2026-46548
### Summary The `request-filtering-agent` SSRF protection was non-functional in the four notification webhook plugins (
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
CVE-2026-46547
### Summary A reflected XSS vulnerability exists in the Page Leaving Warning page. The `ncRedirectUrl` and `ncBackUrl` q
The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all...
CVE-2026-1881
The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includ
Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents...
CVE-2026-47782
Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL v
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's...
CVE-2026-9150
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser w
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim...
CVE-2026-9149
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted
Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179...
CVE-2026-9124
Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacke
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote...
CVE-2026-9122
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentiall
The CSP report endpoint intended to limit logged CSP reports to 1 KB but incorrectly allowed...
CVE-2026-9137
The CSP report endpoint intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before t
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a...
CVE-2026-9110
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179...
CVE-2026-9116
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker t
Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179...
CVE-2026-9115
Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-9082
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote...
CVE-2026-9113
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search...
CVE-2026-35016
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authen