A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter.

CVE Database V5

Detailed information about CVE-2026-79035: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-79035: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-79035: n/a

besluiten

documenten-api

NL Portal Backend Libraries versions from 1.5.0 up to but not including 3.0.1 have a vulnerability in the nl.nl-portal:besluiten package where GraphQL resolvers lack per-user authorization. This allows authenticated users to access document contents, decisions, audit trails, and decision attachments belonging to other users. The issue is fixed in version 3.0.1. A workaround is to block the affected GraphQL operations or types at the API gateway.

The nl.nl-portal:besluiten package in NL Portal Backend Libraries versions >=1.5.0 and <3.0.1 suffers from an authorization bypass vulnerability in its GraphQL resolvers. This flaw permits an authenticated user to access sensitive information such as other users' documents, decisions, audit trails, and attachments without proper authorization checks. The vulnerability is tracked as CVE-2026-49463 with a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily due to confidentiality loss. The issue is resolved in version 3.0.1, which includes a patch to enforce per-user authorization. As a mitigation, blocking the relevant GraphQL operations or types at the API gateway can serve as a temporary workaround.

Detailed information about CVE-2026-49463: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:besluiten affecting nl-

CVE-2026-49463: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:besluiten - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-49463: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:besluiten

nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration.

Detailed information about CVE-2026-49462: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:app affecting nl-portal

CVE-2026-49462: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:app - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-49462: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:app

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

This vulnerability (CWE-79) in Microsoft Edge (Chromium-based) involves improper neutralization of input during web page generation, leading to cross-site scripting (XSS). Exploitation could allow an attacker to conduct spoofing attacks remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. Confidentiality and integrity impacts are low, with no availability impact. Microsoft has published an official fix for affected versions.

Detailed information about CVE-2026-77490: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft E

CVE-2026-77490: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft Edge (Chromium-based) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-77490: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft Edge (Chromium-based)

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php

Detailed information about CVE-2026-52630: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-52630: n/a

CVE-2026-52630: n/a

Description

Technical Details

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional

CVE-2026-52630: n/a

CVE-2026-52630: n/a

Description

Technical Details

Community Reviews

Related Threats

CVE-2026-79035: n/a

CVE-2026-49463: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:besluiten

CVE-2026-49462: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in nl-portal nl.nl-portal:app

CVE-2026-77490: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft Edge (Chromium-based)

CVE-2026-54135: CWE-400: Uncontrolled Resource Consumption in SimulPiscator AirSane

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional