37410 matches found
CVE-2026-76271
The Discover Splunk Observability Cloud app for Splunk Enterprise is vulnerable to a Denial of Service (DoS) condition in versions below 10.4.3 , 10.2.7 , and 10.0.10 (note: 9.4.x is not affected). A low-privileged user without "admin" or "power" roles can exploit the issue by submitting input to...
CVE-2026-76271 Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...
CVE-2026-76267
In Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 , a log injection vulnerability exists within the Splunk App for Splunk O11y Cloud . An attacker with the read_o11y_content capability can inject forged entries into the application log via the REST API . This occurs because the ap...
EUVD-2026-94619
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...
CVE-2026-76267 Log Injection through the REST API in Splunk App for Splunk O11y Cloud
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...
NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...
GHSA-F87G-XV8R-7P7X Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...
CVE-2023-25813-TEST
CVE Test App Sequelize CVE-2023-25813 동작을 로컬에서 확인하기 위한 Express + MySQL 실습 앱입니다. 이 프로젝트는 의도적으로 취약한 Sequelize 버전과 취약한 로그인 쿼리 패턴을 유지합니다. 인터넷에 노출하지 말고 로컬 Docker 실습 환경에서만 실행하세요. 配置 Web: Express, EJS DB: MySQL 8.0 ORM: Sequelize 6.19.0 Docker DB 포트: localhost:3307 Web 포트: localhost:3000 主要功能： 注册 登录/登出...
NextJS-app-CVE-2025-55182
Next.js CVE-2025-55182 概念验证 这是 Next.js 应用程序的概念验证，受到 CVE-2025-55182 （也称为 "React2Shell"）的影响，这是一个 React 服务器组件中的严重远程代码执行（RCE）漏洞。 ⚠️ 警告 此应用程序故意包含漏洞，仅应用于： 安全研究 教育目的 在隔离环境中测试 不要： 部署到生产环境 暴露给不受信任的网络 与敏感数据一起使用 漏洞详情 CVE-2025-55182 影响： React 版本 19.0.0 到 19.2.0 Next.js 版本 15.x 和 16.x（使用 App Router） 使用 React...
ish
iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...
CVE-2026-107204
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...
EUVD-2026-93570
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions...
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...
EUVD-2026-93572
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained...
GHSA-5M6H-8G35-P3M7 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...
GHSA-VHHQ-M2GM-RWC9 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...