Aggregator

Submit #813434 / VDB-365351

Submit #813433 / VDB-365350

Submit #813432 / VDB-365349

Submit #813431 / VDB-365348

Submit #813429 / VDB-365347

Опасность скрывалась не в редком баге, а в чрезмерном доверии к готовым решениям.

太阳几何学基础

Submit #813427 / VDB-365346

Submit #811560 / VDB-365345

Submit #811559 / VDB-365344

Submit #811558 / VDB-365343

Submit #811556 / VDB-365342

Submit #811555 / VDB-365341

A vulnerability identified as problematic has been detected in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. This vulnerability is traded as CVE-2026-9377. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability categorized as critical has been discovered in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCenter Article Submission Endpoint. Executing a manipulation of the argument id/userId can lead to improper authorization. This vulnerability appears as CVE-2026-9376. The attack may be performed from remote. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #813270 / VDB-365340

Submit #813253 / VDB-365339

Italian authorities have dismantled a piracy ecosystem centered around the CINEMAGOAL app that provided access to various streaming platforms, including Netflix, Disney+, and Spotify. [...]

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. It has been rated as critical. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. This vulnerability is reported as CVE-2026-9374. The attack is possible to be carried out remotely. No exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.