EUVD-2026-93992

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates...

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates

Impact Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a...

GHSA-C36C-CF6R-GHGJ Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates

Impact Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a...

EUVD-2026-43178

PraisonAI: Crawl4AI/Chromium backend is also affected by the webcrawl SSRF validation bypass...

CVE-2026-97715

CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service...

zeek-asyncrat-detector

Zeek ベースの AsyncRAT マルウェア検出器 マルウェアは、そのコマンド＆コントロール（C2）サーバーとの通信をHTTPS上に隠すことがよくあります。 HTTPSの暗号化により、マルウェアは通常、その目的を達成するのに十分な期間、侵害を隠蔽します。そのため、HTTPSを使用するマルウェアの検出は困難ですが、今回のAsyncRATのように、時には幸運な突破口が得られることもあります。AsyncRATは、過去1年間に米国の重要インフラを管理する組織を標的として展開されてきたWindowsリモートアクセスツールです。 Notice.log 出力の例 separator \x09...

wp-secure-mcp

wp-secure-mcp 通俗地说： 这允许 AI 代理通过真实的 WordPress 应用程序密码——wp-admin 已经签发的同一种凭据类型——读取并轻度写入 WordPress 站点，除此之外别无其他。这里没有注册表单，没有 OAuth 客户端注册，没有任何形式的令牌端点。同一领域的一个插件恰恰发布了这些东西，而这正是一个未认证攻击者带着完整管理员权限全身而退的方式。 一个通过 REST API 暴露 MCP 服务器的 WordPress 插件，其安全模型是核心要点，而非功能清单上的一条。 这个插件存在的意义：堵住那个绕过漏洞 CVE-2026-15015，CVSS...

cve-2021-41773-nse

cve-2021-41773-nse By George Labrin @creadpag N|Solid Checks if Server is vulnerable to Apache 2.4.49 CVE-2021-41773. POC Open your favorite Terminal and run these commands. First Tab: mv cve-2021-41773.nse /usr/share/nmap/scripts/ Second Tab: sudo nmap -Pn --script=cve-2021-41773.nse X.X.X.X -p ...

EUVD-2026-94577

CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service...

CVE-2024-27348

CVE-2024-27348 오직 윤리적 용도로만 사용하십시오. 유해하거나 악의적인 활동은 허용되지 않으며, 책임은 사용자 본인에게 있습니다. 취약점 분석 내용은 여기에서 확인할 수 있습니다: https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/ Apache HugeGraph Server RCE 스캐너CVE-2024-27348입니다. 이 스캐너는 대상에서 4가지 명령host, ping, curl, wget을 실행하는데, 이는 해당 유틸리티 중 하나가 없...

Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak System

Summary Multiple vulnerabilities affect IBM Cloud Pak System. These vulnerabilties have been addressed with IBM Cloud Pak System 2.3.5.1. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...

CVE-2025-31486-Simulation

Vite Path Traversal Lab CVE-2025-31486 A hands-on, containerized lab environment to simulate and exploit the Path Traversal vulnerability in Vite's development server, identified as CVE-2025-31486. 📖 About The Vulnerability This lab demonstrates a significant Path Traversal vulnerability found in...

CVE-2025-66478

1 POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...

EUVD-2026-94003

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...

CVE-2026-106574

A flaw was found in ImageMagick. An attacker connected to the distributed pixel cache server can send crafted pixel data that triggers an integer calculation error, leading to a heap buffer overwrite. This issue causes the server to crash, resulting in a Denial of Service DoS...

CVE-2026-106570

A flaw was found in ImageMagick. An unauthenticated attacker on an adjacent network can cause a Denial of Service DoS by repeatedly establishing connections to the distributed pixel cache server. This behavior exhausts the pool of available connections, preventing legitimate clients from accessin...

CVE-2026-94127

CVE-2026-94127 — F5 BIG-IP APM 検出ツール（防御用） 作者: https://github.com/FurkanKAYAPINAR/ CVE-2026-94127 に対する防御目的の非エクスプロイト 検出ツールです。これは F5 BIG-IP APM におけるヒープベースのバッファオーバーフロー（CWE-122）であり、未認証のリモート攻撃者がリモートコード実行（RCE）を達成できる 脆弱性です。 CVSS 3.1: 9.8 / CVSS 4.0: 9.3（Critical） 野外で活発に悪用されている — CISA KEV カタログに掲載。 F5 アドバイ...

CVE-2026-93536

A flaw was found in the X.Org Server. When a window is removed during an active gesture, the server fails to clean up references to the destroyed window in its gesture tracking data. A local attacker can exploit this flaw to cause a use-after-free condition—where the system accesses memory after ...

CVE-2026-93524

A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension XKB requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data...

CVE-2026-93520

A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...