CVE-2026-106185

A medium-severity improper input validation vulnerability exists in the Viz component of Google Chrome prior to version 155.0.8059.39 . A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to bypass system access restrictions . While the vulnerabilit...

CVE-2026-106185

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106396

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty

Summary IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host a...

CVE-2026-31156

CVE-2026-31156 There is a path injection vulnerability in OpenPLC-v3, which arises from the program not performing any validity checks on the file path parameters passed in from the command line. Attackers can read any readable file by constructing malicious paths, posing a risk of information...

CVE-2026-106114 ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and...

CVE-2026-106114 ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and...

CVE-2024-10914__POC

CVE-2024-10914 - Proof of Concept Exploit para vulnerabilidad de inyección de comando en el endpoint /cgi-bin/accountmgr.cgi. Esta vulnerabilidad permite ejecutar comandos arbitrarios en el sistema afectado a través de parámetros no sanitizados. Descripción de la Vulnerabilidad CVE-2024-10914 es...

CVE-2024-34693

CVE-2024-34693: Lectura Arbitraria de Archivos del Servidor en Apache Superset Vulnerabilidad de validación de entrada incorrecta en Apache Superset, que permite a un atacante autenticado crear una conexión MariaDB con localinfile habilitado. Al habilitar localinfile en el cliente MySQL/MariaDB d...

CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Ejecución remota de código de nombres locales proporcionados por el usuario en Rails Ejecución remota de código de nombres locales proporcionados por el usuario en Rails 5.0.1 Había una vulnerabilidad en versiones de Rails anteriores a la 5.0.1 que permitiría a un...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

CVE-2023-43364-Searchor-RCE-Exploit

CVE-2023-43364 – Exploit RCE de Searchor PoC Ejecución Remota de Código RCE mediante uso inseguro de eval en Searchor --test Ejecutar comando personalizado Ejecutar cualquier comando en el servidor objetivo: python3 CVE-2023-43364.py -a "whoami" Ejemplos: python3 CVE-2023-43364.py -a "TF=$mktemp...

CVE-2026-34498

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

ActiveScanPlusPlus

ActiveScan++ ActiveScan++ extends Burp Suite's active and passive scanning capabilities. Designed to add minimal network overhead, it identifies application behaviour that may be of interest to advanced testers: Potential host header attacks password reset poisoning, cache poisoning, DNS rebindin...

EUVD-2026-93398

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-34498 L4L

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-34498

An improper input validation vulnerability exists in Johnson Controls Illustra Standard - L4L China on Windows platforms. This flaw allows for OS Command Injection , specifically affecting versions before 6.0.0.66394 . The documents do not provide specific technical details regarding the vulnerab...

CVE-2026-12380

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the E-Commerce Pack by Akıllı Ticaret Software Technologies Ltd. Co. due to improper neutralization of input during web page generation. This flaw allows attackers to execute malicious scripts in a user's browser. The issue affects ve...

CVE-2026-56596

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...