CVE-2026-90668

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90492

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90491

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

CVE-2026-90668

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90492

CVE-2026-90492 is an OS command injection vulnerability in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 . The flaw resides in the controller_listen/controller_recover functions of py/web.py , where unsanitized input in the case_name argument allows remote command execution. The attack can be...

CVE-2026-90492 webgjc web_robot web.py controller_recover os command injection

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90490

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be...

CVE-2026-90491 sanjevirau gsubs Electron index.js showQuerySuccessPage code injection

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

CVE-2026-90491

sanjevirau gsubs (up to version 1.0.3) contains a code injection vulnerability in the showQuerySuccessPage function of renderer/index.js within its Electron component. The root cause is an improper handling of the filename argument, which can be manipulated by a remote attacker to inject and exec...

eJPT-Prep-Guide

eJPT-Prep-Guide eJPT Junior Penetration Tester preparation a...

CVE-2026-90490

lenve vhr 1.0-SNAPSHOT is affected by a deserialization flaw in the MailReceiver component that can be exploited remotely with low privileges and no user interaction. The vulnerability yields low impact on confidentiality, integrity, and availability (CVSS 3.1 base score 6.3 , MEDIUM). A proof-of...

CVE-2026-90490 lenve vhr MailReceiver deserialization

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be...

EUVD-2026-76931

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be...

EUVD-2026-76916

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...

EUVD-2026-76922

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

EUVD-2026-76925

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

EUVD-2026-76921

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

EUVD-2026-76923

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc in wasmrtallocatefuncreftable wasm2c/wasm-rt-impl-tableops.inc. When the funcref table allocation...

EUVD-2026-76924

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...