Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via ambiguous path-key encoding in lib/compiler.js, where the compiler tracked table origins using string-rendered path sets rather than per-object tags. Because quoteDottedString quotes a segment only when it contai...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via ambiguous path-key encoding in lib/compiler.js, where the compiler tracked table origins using string-rendered path sets rather than per-object tags. Because quoteDottedString quotes a segment only when it contai...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via mergeIncrementalResult when path segments are processed by setObjectKeyPath. An attacker can supply a path containing a...

Black: GitHub Action installs unvalidated required-version from pyproject.toml

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if usepyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

GHSA-CG8M-R9F2-5WM2 Black: GitHub Action installs unvalidated required-version from pyproject.toml

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if usepyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-ioc Were you hit by PHP2Shell? A read-only triage...

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618 / CVE-2026-109619 Two critica...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109618-POC Multipart OOM bailout corruption trigger...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell Check websites and servers for PHP2Shell CVE-2026...

Dependency on Vulnerable Third-Party Component

Overview next is a react framework. Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component via the sharp image processing dependency used by next/image. A vulnerable version of sharp is bundled as an optional dependency, and an attacker can exploit a fl...

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution RCE when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh...

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used vulnerability discovered by ? in WordPress npm next versions = 10.0.0, = 15.5.27...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Testeur CVE-2026-109618 / CVE-2026-109619 php2shell Un scri...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — Refactored POC for CVE-2026-109618 / CVE-2026-1096...

OESA-2026-4422 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4423 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4421 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4420 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4414 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...