Archive
March 2026
Vulnerabilities first published in this month (UTC), newest first.
2,574 results · Clear filters · Feed
-
Medium 4.3
Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.
-
Medium 5.3
Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.
-
Medium 6.1
UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.
-
Medium 5.4
Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.
-
Medium 4.3
Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.
-
Medium 6.5
Nanoleaf Lines unauthenticated firmware file store
Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. Fixed in 12.3.6.
-
Medium 5.4
A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying …
-
Medium 6.5
Authenticated query containing a TKEY record may cause named to terminate unexpectedly
Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configurati…
-
Medium 4.8
Reflected Cross Site Scripting (XSS) vulnerability in Support Board
A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the 'search' parameter in '/suppo…
-
Medium 5.1
Ericsson Indoor Connect 8855 - Cross-Site Request Forgery Vulnerability
Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lead to unauthorized modification of certain information.
-
Medium 5.7
SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authenti…
-
Medium 5.3
PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive Download
The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.
-
Medium 6.7
SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the …
-
Medium 4.3
Open Redirect Vulnerability in Hitachi Ops Center Administrator
Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.
-
Medium 6.4
Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta
The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied…
-
Medium 4.3
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and i…
-
Medium 6.2
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS …
-
Medium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26…
-
Medium 6.8
A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS …
-
Medium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26…
-
Medium 5.5
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sono…
-
Medium 4.3
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, ma…
-
Medium 5.5
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS…
-
Medium 6.5
A file access issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.4. An attacker …
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app ma…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be abl…
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 1…
-
Medium 5.3
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS S…
-
Medium 5.3
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …
-
Medium 5.9
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 1…
-
Medium 5.3
This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be…
-
Medium 5.3
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS…
-
Medium 6.5
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.7 and iPadOS…
-
Medium 5.3
A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Tahoe 26.4. An app may be able to …
-
Medium 5.3
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS T…
-
Medium 6.5
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4…
-
Medium 5.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
Medium 6.3
itsourcecode College Management System Parameter add-single-student-results.php sql injection
A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/add-single-student-results.php of the component Parameter Handler. The manipulation of the argument course_code leads …
-
Medium 5.3
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sono…