EUVD-2026-94125

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

coeus-ci

Coeus CI Competitive Intelligence, die alles sieht. Benannt nach Coeus SEE-us, dem 100‑augigen griechischen Titanen des wissbegierigen Geistes – dessen Name wörtlich „fragend“ bedeutet. CI steht für Competitive Intelligence. Ein Business‑Intelligence-OSINT‑Tool, das Unternehmensprofile aus...

kernel: dm cache policy smq: fix missing locks in invalidating cache blocks

A flaw was found in the Linux kernel's device-mapper dm cache policy, specifically within the smq module. In passthrough mode, the invalidatemapping operation lacks proper locking, allowing for concurrent access. This can lead to data races, resulting in data corruption or use-after-free issues,...

spring4shell-local-verification-lab

Progetto di verifica delle condizioni di impatto locale, riparazione e ripetizione del test per Spring4Shell Introduzione al progetto Questo progetto è utilizzato per apprendere e verificare Spring Framework CVE-2022-22965, noto anche come vulnerabilità Spring4Shell, comprese le condizioni di...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – Proof of Concept für SQL-Injection Team-Informationen Teamname: The Misfits Teammitglieder: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Überblick Dieses Repository enthält eine anfällige Webanwendung, die als Proof of Concept PoC erstellt wurde, um ein...

moveit-transfer-2023-breach

Violazione massiva di dati MOVEit Transfer 2023 Dettagli dell'incidente Data dell'incidente: maggio–giugno 2023 CVE: CVE-2023-34362 Tipo di attacco: SQL Injection Attore della minaccia: gruppo ransomware Cl0p Riepilogo Nel maggio 2023, una vulnerabilità di SQL injection in MOVEit Transfer è stata...

CVE-2025-68664

CVE-2025-68664 Tutto ciò che voglio per Natale sono i tuoi segreti: LangGrinch colpisce il core di LangChain CVE-2025-68664 Autore: Yarden Porat Ricerca Cyata: Vulnerabilità LangGrinch in LangChain Pubblicato: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Ieri LangChain ha...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL-Injection in Online Shopping System Advanced Zusammenfassung Eine kritische SQL-Injection-Schwachstelle wurde im Projekt Online Shopping System Advanced von PuneethReddyHC entdeckt. Der Fehler befindet sich in action.php, das die Benutzereingaben des...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 — clean-room OpenAM PoC This package rebuilds...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

Joomla! <3.7.1 - SQL Injection

Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-8917 info: name: Joomla! 3.7.1 - SQL Injection...

Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...

SonicWall GMS and Analytics - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics:...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

Zabbix - SQL Injection

Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php and perform SQL injection attacks. id: CVE-2016-10134 info: name: Zabbix - SQL Injection author: princechaddha severity: critical description: Zabbix...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-97680

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...