CVE-2026-71319

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

CVE-2026-71312

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-71310 rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

CVE-2026-63457

A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 iLO 6 prior to v1.78...

CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

CVE-2026-14587

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

CVE-2026-67623

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for educationa...

claudit

claudit – AI-based code security auditing tool claudit is an...

Allocation of Resources Without Limits or Throttling

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching of symbol values. An attacker can exhaust system resources by sending specially crafted data prior t...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through improper handling of type size and count during the pre-authentication phase. An attacker can exhaust system resources by sending specially crafted requests that trigger excessive memo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded symbol value caching in the AMQP 1.0 Symbol codec. An attacker can exhaust broker resources by sending pre-authentication AMQP 1.0 traffic that forces the codec to creat...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources by sending specially crafted requests prior to authentication. Remediation Upgrade...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via improper handling of type size and count during the pre-authentication process. An attacker can trigger excessive memory allocation by sending specially crafted input, potentially leading ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources and cause a denial of service by sending specially crafted requests prior to authentication...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unchecked AMQP 1.0 list and map size/count handling in the ListConstructor and MapConstructor codec classes. An attacker can trigger excessive allocation and parser work by...

Uncontrolled Recursion

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded nesting in the type processing. An attacker can cause a stack overflow and disrupt service availability by sending specially crafted...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded nesting of types in the process. An attacker can cause a stack overflow and disrupt service availability by sending specially crafted data prior to authentication. Remediation Upgrade...

CVE-2026-68073

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...

CVE-2026-67590

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...