https://vulnerability.circl.lu Latest vulnerabilities published by the CNAs operating under the ENISA root of the CVE Program. http://www.rssboard.org/rss-specification python-feedgen en Tue, 18 Aug 2026 17:18:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-18929 Resource Exhaustion in Carbone Resource Exhaustion in Carbone https://vulnerability.circl.lu/vuln/cve-2026-18929 Tue, 18 Aug 2026 09:11:38 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora https://vulnerability.circl.lu/vuln/cve-2026-75531 Mon, 17 Aug 2026 21:00:12 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora https://vulnerability.circl.lu/vuln/cve-2026-75529 Mon, 17 Aug 2026 20:52:42 +0000 https://vulnerability.circl.lu/vuln/cve-2026-40126 DOM-based Cross-Site Scripting in OutSystems Service Center DOM-based Cross-Site Scripting in OutSystems Service Center https://vulnerability.circl.lu/vuln/cve-2026-40126 Mon, 17 Aug 2026 12:03:38 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74767 Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb https://vulnerability.circl.lu/vuln/cve-2026-74767 Sat, 15 Aug 2026 21:56:44 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74764 Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora https://vulnerability.circl.lu/vuln/cve-2026-74764 Sat, 15 Aug 2026 21:39:09 +0000 https://vulnerability.circl.lu/vuln/cve-2026-59109 Zalktis: SQL injection via partner-controlled fields in imported e-invoices Zalktis: SQL injection via partner-controlled fields in imported e-invoices https://vulnerability.circl.lu/vuln/cve-2026-59109 Thu, 13 Aug 2026 16:40:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-73432 Wed, 12 Aug 2026 14:40:15 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-73431 Wed, 12 Aug 2026 14:32:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-73405 Wed, 12 Aug 2026 14:15:58 +0000