Skip to content
Signals
NVD · CVE-2026-64604 · In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8NVD · CVE-2026-64603 · In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda1NVD · CVE-2026-64602 · In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung ChuNVD · CVE-2026-64601 · In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on eachCISA KEV · CVE-2026-33824 · 9.8 · Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability · Added 2026-08-18 · Due 2026-08-21CISA KEV · CVE-2026-59310 · 9.8 · Broadcom VMware vCenter Path Traversal Vulnerability · Added 2026-08-18 · Due 2026-08-21NVD · CVE-2026-64604 · In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8NVD · CVE-2026-64603 · In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda1NVD · CVE-2026-64602 · In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung ChuNVD · CVE-2026-64601 · In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on eachCISA KEV · CVE-2026-33824 · 9.8 · Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability · Added 2026-08-18 · Due 2026-08-21CISA KEV · CVE-2026-59310 · 9.8 · Broadcom VMware vCenter Path Traversal Vulnerability · Added 2026-08-18 · Due 2026-08-21
Dragons Community

Vendors · sfu

sfu

· Vendor

Total CVEs

18

Critical

0

Products

4

Search All CVEs →

18

Products (4)

pkp web application library12 CVEsopen journal system3 CVEsopen journal systems2 CVEscustomlocale1 CVEs

Recent Vulnerabilities

View all 18 →
CVE-2024-25436MEDIUM 6.1

A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.

CVE-2023-5904MEDIUM 5.4

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5903MEDIUM 5.4

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5902MEDIUM 4.3

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5901LOW 3.5

Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5900LOW 3.5

Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-47271MEDIUM 5.3

PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.

CVE-2023-5897HIGH 8.8

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.

CVE-2023-5896MEDIUM 5.4

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.

CVE-2023-5895MEDIUM 5.4

Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5894MEDIUM 5.4

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.

CVE-2023-5893HIGH 8.8

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5892MEDIUM 5.4

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5891MEDIUM 5.4

Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5890MEDIUM 5.4

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5626HIGH 8.8

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.

CVE-2019-19909HIGH 8.8

An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.

CVE-2018-12229

Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).