exploit-foxit-4.1.1-title-bof

This repository does not have a README...

hp-slate7-root-kit

Root for the HP Slate 7 2800 on Android 4.1.1 English | Русский This repository contains a complete, self-contained kit for obtaining persistent root access on the HP Slate 7 2800 running firmware 1.05.18 and kernel Linux 3.0.8+ by exploiting the local vulnerability CVE-2015-1805. The kit was run...

CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CLEANSTART-2026-DG62479 Security fixes in cassandra-reaper-fips 4.1.1-r3

Package cassandra-reaper-fips version 4.1.1-r3 fixes 4 vulnerabilities: CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-10050...

CLEANSTART-2026-IX44091 Security fixes in py3-langgraph-checkpoint 4.1.1-r0

Package py3-langgraph-checkpoint version 4.1.1-r0 fixes 1 vulnerabilities: ghsa-f4xh-w4cj-qxq8...

CLEANSTART-2026-YI37990 Security fixes in kafka 4.1.1-r0

Package kafka version 4.1.1-r0 fixes 1 vulnerabilities: ghsa-vc5p-v9hr-52mj...

CLEANSTART-2026-QS73342 Security fixes in spark-sc213-jdk17-py314 4.1.1-r1

Package spark-sc213-jdk17-py314 version 4.1.1-r1 fixes 2 vulnerabilities: ghsa-84h7-rjj3-6jx4, ghsa-vc5p-v9hr-52mj...

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact fast-uri v4.1.0 and earlier do not treat a literal backslash U+005C as an authority delimiter. Node's native WHATWG URL used by fetch, undici, and Node's http/https clients normalizes \ to / for special schemes http, https, ws, wss, ftp, file, so the two parsers extract different hosts fro...

SUSE CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CLEANSTART-2026-VB75499 Security fixes for ghsa-f4xh-w4cj-qxq8 applied in versions: 4.1.1-r0

Security vulnerability affects the py3-langgraph-checkpoint package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

CVE-2026-63071

Apache Syncope is vulnerable to an Improper Isolation or Compartmentalization flaw due to a bypass in the Groovy security sandbox (specifically the GroovySandboxScriptEngineImpl in the core/spring module). An administrator with entitlements to manage Implementations can create a malicious Groovy ...

EUVD-2026-45955

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

EUVD-2026-44494

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications...

CVE-2026-48815

Summary of CVE-2026-48815 : In sigstore-js, the documented certificateOIDs option in sigstore.verify() is accepted by the public API before verification but discarded during verification, causing certificate extension OIDs to not be checked. This allows applications to accept unauthorized certifi...

CVE-2026-48815 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications...

CVE-2026-48815

A flaw was found in sigstore. The certificateOIDs option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface API but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing...

CLEANSTART-2026-TF97968 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-1229, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27141, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 3.19.0-r0, 4.0.0-r0, 4.0.1-r0, 4.1.1-r1, 4.2.0-r1

Multiple security vulnerabilities affect the helm package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-59700

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get resource method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using...