CVE-2026-93749 vulnerabilities

Vulnerabilities for packages: vitess, langfuse, jupyter-base-notebook, saf, opensearch-dashboards, nextcloud-server, rancher-api-ui...

GHSA-68FV-2MGG-JV7Q vulnerabilities

Vulnerabilities for packages: vitess, langfuse, jupyter-base-notebook, saf, opensearch-dashboards, nextcloud-server, rancher-api-ui...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

Jellyfin <10.7.0 - Local File Inclusion

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. id: CVE-2021-21402 info: name: Jellyfin 10.7.0 - Local File Inclusion author: dwisiswant0 severity: medium...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

[SECURITY] Fedora 44 Update: httpd-2.4.69-1.fc44

The Apache HTTP Server is a powerful, efficient, and extensible web server...

[SECURITY] Fedora 44 Update: janus-1.4.2-1.fc44

Janus is an open source WebRTC server designed and developed by Meetecho...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

EUVD-2026-94154

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server , an authenticated user with permissions to modify roles can achieve privilege escalation . The vulnerability is caused by the improper validation of unsafe equivalence in inputs , allowing an attacker to weaken built-in roles and add their account to a priv...

study-CVE-2025-55182

Studio su CVE-2025-55182 Repository per lo studio della vulnerabilità Remote Code Execution RCE in React Server Components. 🔴 Avvertenza Utilizzare solo a scopo didattico. L'uso contro sistemi altrui senza autorizzazione è illegale. 📋 Panoramica della vulnerabilità Campo| Contenuto ---|--- CVE ID...

POC-CVE-2025-55182

Scanner per CVE-2025-55182 Semplice strumento da riga di comando per rilevare e sfruttare CVE-2025-55182 RCE dei React Server Components nelle applicazioni Next.js. Installazione chmod +x scanner.sh Utilizzo Scan with default command id ./scanner.sh -d example.com Execute custom command...

NextChat_SSRF_CVE-2023-49785

NextChatSSRFCVE-2023-49785...

CVE-2025-55184

React2Shell PoC Questo repository fornisce un ambiente minimale e volutamente vulnerabile per testare gli scanner di sicurezza contro la recente vulnerabilità critica di RCE React2Shell che colpisce React Server Components e Next.js. CVE-2025-55182 : Esiste una vulnerabilità di esecuzione remota ...

CVE-2025-55182

CVE-2025-55182 Autore originale:https://github.com/msanft/CVE-2025-55182 Questa vulnerabilità consente RCE in React Server Functions, ad esempio offerte da Next.js tramite riferimenti non sicuri al prototipo. Non sono un esperto di React o Next.js, quindi prendi tutte le informazioni qui con le...