CVE-2026-94485

The Next.js framework (versions 16.0.0 through 16.3.8 ) contains a vulnerability in the next dev development server. The server exposes a Model Context Protocol (MCP) endpoint that lacks reliable restrictions on cross-site requests . If a developer visits a malicious website while the development...

CVE-2026-94485

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the "next dev" development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read...

cve-2026-22732-poc

CVE-2026-22732 — Proof of Concept Spring Security は HTTP レスポンスのセキュリティヘッダーを黙って破棄する。デモ／教育目的のみ。このローカルアプリ以外に対して実行しないこと。 | ---|--- CVE| CVE-2026-22732 CWE-425、公開 2026-03-19 CVSS 3.1| 9.1 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 直接依存| spring-boot-starter-web + spring-boot-starter-security 2.7.18...

CVE-2026-94486

The Next.js React framework contains a vulnerability in the next dev development server, specifically affecting versions 16.0.0 through 16.3.8 . The server exposes a Model Context Protocol (MCP) endpoint that fails to reliably restrict cross-site requests. This flaw allows an attacker to issue un...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.67 fixes various security issues: The following security issues were fixed: CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283. CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextc...

semgrep v1.179.0

Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...

Exploit for Argument Injection in Thecodingmachine Gotenberg

CVE-2026-40281 Gotenberg --- 📖 Table of...

CVE-2026-93875

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

armadito-av

Armadito 코어 Armadito는 오픈소스 안티바이러스입니다. 이 저장소에는 Armadito 코어 라이브러리, 데몬 및 서비스가 포함되어 있습니다. Copyright C Teclib', 2015, 2016 프로젝트 홈 : http://www.teclib-edition.com/teclib-products/armadito-antivirus 온라인 문서: http://armadito-av.readthedocs.io/en/latest/ 라이선스 : LGPLv3...

Exploit for Argument Injection in Thecodingmachine Gotenberg

CVE-2026-42589 - C...

xss2shell

🔥 XSS2Shell — CVE-2026-64638 スキャナー & PoC ツールキット ビヘイビアファーストのマススキャナー兼エビデンスグレードのPoCジェネレーター。5億以上のWebサイトに影響するWordPressの 認証前XSS-to-RCEチェーンに対応します。 検出のみ。武器化は一切行いません。バグバウンティプログラムとブルーチーム向けに作られています。 公式チェッカー: https://pwn.ai/xss2shell-checker.html これは何か？ • クイックスタート • Shodan ダークス • 使い方 • 判定マトリックス • 検出 • FAQ 🔎...

chef-mysql-hardening

mysql-hardening Chef cookbook 説明 mysql のセキュリティ設定を提供します。攻撃者に対する攻撃面を最小限に抑えた設定で、本番環境に対応した mysql インスタンスをセットアップすることを目的としています。 この cookbook は mysql のセキュリティ設定に焦点を当てており、インストールには mysql cookbook を再利用しています。そのため、Chef で既存の mysql 設定の上にこのハードニング層を追加できます。 この cookbook は os-hardening および ssh-hardening...

Security update for the Linux Kernel RT (Live Patch 15 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.54 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283...

cdn-ip-scanner

CDN IP Scanner V2.0 高精度 • 超高速 • AI搭載 English • فارسی • Download • Donate 🇬🇧 English CDN IP Scannerとは？ CDN IP Scanner は、最速のCDN（コンテンツ配信ネットワーク）IPアドレスをスキャンして見つけるための強力なWebベースのツールです。Cloudflare 、Fastly 、その他のCDNネットワークなどのプロバイダーから、クリーンで低遅延のIPを発見するのに役立ちます。 このスキャナーは、/cdn-cgi/trace エンドポイントチェックを伴う実績のある5回試行検証方式...

CVE-2026-93875

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.2.1 . The root cause is insufficient input sanitization and output escaping of the 'friendlyTime' parameter. This flaw allows unauthenticated attackers to inject arbi...

CVE-2026-93875 JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...