A vulnerability in Johnson Controls C-CURE 9000, Victor version 3.20 allows insertion of sensitive information into log files. This flaw could enable an attacker with limited privileges to use known operating system credentials, potentially leading to significant confidentiality, integrity, and availability impacts.
A vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer version 1.1.0.0 allows sensitive information to be stored in cleartext in memory. This exposure could enable an attacker with local access and limited privileges to retrieve embedded sensitive data. The vulnerability has a high severity score of 8.6 according to CVSS 4.0 metrics.
A stored cross-site scripting (XSS) vulnerability exists in WPMU DEV Forminator plugin versions up to 1.58.3. This vulnerability results from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
HCL AION has a vulnerability due to a missing or insecure Cross-Origin-Opener-Policy (COOP) header. This flaw allows cross-origin documents to share a browsing context with the application, which may enable cross-window attacks and cause unintended behavior or security issues under certain conditions.
HCL AION's GenAI web interface contains an open redirect vulnerability in its navigation bar component. The vulnerability arises from the 'switch-version' action redirecting users to a dynamically constructed URL without validating the destination. This flaw could be exploited in phishing attacks, potentially causing unintended behavior or security issues under specific conditions. The vulnerability has a medium severity rating with a CVSS score of 4.7.
HCL AION has a vulnerability where user input is included in HTTP response headers without properly neutralizing carriage return and line feed characters. This can allow attackers to inject additional headers or split HTTP responses, potentially causing unintended behavior or security issues. The vulnerability has a medium severity with a CVSS score of 6.5. No affected versions or patches are explicitly stated in the available data.
HCL AION has an open redirect vulnerability in its user registration page's Signup component. The vulnerability arises because the 'redirect' query parameter is used without validation after registration, allowing attackers to craft links that redirect users to untrusted external sites. This flaw can be exploited in phishing attacks, potentially causing unintended user redirection and limited confidentiality impact.
HCL AION contains an open redirect vulnerability in the role assignment pending page. The login page redirect URL is sourced from a build configuration variable without validation, which could be exploited in phishing attacks. This vulnerability has a medium severity rating with a CVSS score of 4.7.
A security vulnerability (CVE-2026-123653) exists in esengine DeepSeek-Reasonix up to version 2.52.0 in the discoverDocs function of internal/memory/doc.go. The flaw involves improper neutralization of input used for large language model prompting, which can be exploited remotely. A public exploit disclosure exists. Upgrading to version 2.53.0 addresses this issue.
HCL AION has a vulnerability due to the absence or insecure configuration of the HTTP Strict-Transport-Security (HSTS) header. This header instructs browsers to always use HTTPS, and its absence may allow connections to be downgraded or intercepted under certain conditions. The vulnerability has a low severity score and does not have known exploits in the wild.
HCL AION contains an open redirect vulnerability in the session-handling logic of its GenAI web interface. The vulnerability arises because the redirect URL to the login page is taken from a build configuration variable without validation, allowing potential redirection to arbitrary destinations. This flaw could be exploited in phishing attacks, leading to unintended user redirection and possible security impacts under certain conditions. The vulnerability has a medium severity score of 4.7 and does not currently have a known exploit in the wild. No affected versions or patch information are provided.
A path traversal vulnerability exists in TÜBİTAK BİLGEM pardus-boot-repair software versions from 1.0.8 up to but not including 1.1.0. This flaw allows an attacker with user interaction to potentially cause limited integrity impact by accessing files outside the intended directory. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A Cross-site Scripting (XSS) vulnerability exists in Elementor Website Builder up to version 4.3.5 due to improper neutralization of input during web page generation, allowing code injection. This vulnerability has a high severity score of 7.1 and can lead to partial confidentiality, integrity, and availability impacts.
A reflected Cross-site Scripting (XSS) vulnerability exists in Elementor Website Builder versions up to 4.3.5. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected website.
A Missing Authorization vulnerability exists in the WP Swings Upsell Order Bump Offer for WooCommerce plugin, affecting versions up to 3.1.6. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity rating with a CVSS score of 7.1.
A path traversal vulnerability exists in pardus-boot-repair versions from 1.0.9 up to but not including 1.1.0. This flaw allows an attacker to improperly access files outside a restricted directory, potentially leading to full confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-123676 is an improper authorization vulnerability in the xxyopen novel software affecting versions 3.0 through 3.5.0. The flaw exists in the BookServiceImpl.getBookContentAbout function, where manipulation of the chapterId argument can bypass authorization controls. The vulnerability can be exploited remotely without authentication. A patch identified by commit 966c4bdde3521dc0a165d15a2acff66ee33eaaa7 is available to fix this issue. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
HCL AION contains a vulnerability where it trusts the HTTP Host header value without validation. This flaw allows an attacker to manipulate the Host header to influence links, redirects, or responses generated by the application, potentially causing unintended behavior or security impacts under certain conditions. The vulnerability is classified under CWE-74 (Injection).
HCL AION is vulnerable due to the absence of the Content-Security-Policy (CSP) header in application responses. This omission means browsers do not restrict script and content sources, increasing the risk of cross-site scripting and content injection attacks. The vulnerability has a low severity score and does not currently have known exploits in the wild.
CVE-2026-123792 is an inefficient algorithmic complexity vulnerability in the Symfony Yaml component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The vulnerability causes the YAML parser to perform excessive repeated work when processing certain crafted YAML documents, leading to exponential or quadratic parsing time growth. This can keep a PHP process busy for extended periods, potentially causing denial of service. The issue affects any code parsing untrusted YAML with default flags, including some Symfony request payload mappings that accept YAML input without restrictions. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7.