Rezultati pretraživanja za 'Od datuma: 01.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-126835 | 6.5 | The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configure | 2026-11-13 17:17:26 | 2026-11-12 17:17:33 |
| CVE-2026-126567 | 5.4 | Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers | 2026-11-13 17:17:26 | 2026-11-11 03:16:51 |
| CVE-2026-126563 | 6.1 | Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Spe | 2026-11-13 17:17:26 | 2026-11-11 03:16:50 |
| CVE-2026-126559 | 4.8 | Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or | 2026-11-13 17:17:26 | 2026-11-11 03:16:49 |
| CVE-2026-126362 | - | Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a | 2026-11-13 17:17:25 | 2026-11-13 00:20:11 |
| CVE-2026-126354 | 4.8 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to | 2026-11-13 17:17:25 | 2026-11-12 22:19:20 |
| CVE-2026-126350 | 5.9 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand op | 2026-11-13 17:17:25 | 2026-11-12 22:19:20 |
| CVE-2026-126346 | 5.9 | basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event | 2026-11-13 17:17:25 | 2026-11-12 22:19:19 |
| CVE-2026-126543 | 7.5 | WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED re | 2026-11-13 17:17:25 | 2026-11-11 01:17:15 |
| CVE-2026-126499 | 7.4 | Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated atta | 2026-11-13 17:17:25 | 2026-11-11 01:17:14 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/13482
Zapisa po stranici: