CVE-2026-76274

Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 are vulnerable to a Server-Side Request Forgery (SSRF) within the Splunk App for Splunk Observability Cloud . An attacker with a role possessing the read_o11y_content capability can exploit the REST API to redirect outbound requests t...

EUVD-2026-94626

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

CVE-2026-76274 Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

CVE-2026-76271 Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...

CVE-2026-76271

The Discover Splunk Observability Cloud app for Splunk Enterprise is vulnerable to a Denial of Service (DoS) condition in versions below 10.4.3 , 10.2.7 , and 10.0.10 (note: 9.4.x is not affected). A low-privileged user without "admin" or "power" roles can exploit the issue by submitting input to...

CVE-2026-76267 Log Injection through the REST API in Splunk App for Splunk O11y Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-76267

In Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 , a log injection vulnerability exists within the Splunk App for Splunk O11y Cloud . An attacker with the read_o11y_content capability can inject forged entries into the application log via the REST API . This occurs because the ap...

EUVD-2026-94619

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

GHSA-F87G-XV8R-7P7X Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...

NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

CVE-2023-25813-TEST

CVE Test App An Express + MySQL practice app for locally verifying the behavior of Sequelize CVE-2023-25813. This project intentionally maintains a vulnerable Sequelize version and a vulnerable login query pattern. Do not expose it to the internet; run it only in a local Docker practice...

NextJS-app-CVE-2025-55182

Next.js CVE-2025-55182 Proof of Concept This is a proof-of-concept Next.js application vulnerable to CVE-2025-55182 also known as "React2Shell", a critical Remote Code Execution RCE vulnerability in React Server Components. ⚠️ WARNING This application is intentionally vulnerable and should ONLY be...

ish

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

CVE-2026-107204

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

EUVD-2026-93570

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions...

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...

EUVD-2026-93572

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained...

GHSA-5M6H-8G35-P3M7 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...

Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...