CVE-2026-93749 vulnerabilities

Vulnerabilities for packages: saf, rancher-api-ui, langfuse, nextcloud-server, vitess, jupyter-base-notebook, opensearch-dashboards...

GHSA-68FV-2MGG-JV7Q vulnerabilities

Vulnerabilities for packages: saf, rancher-api-ui, langfuse, nextcloud-server, vitess, jupyter-base-notebook, opensearch-dashboards...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

Jellyfin <10.7.0 - Local File Inclusion

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. id: CVE-2021-21402 info: name: Jellyfin 10.7.0 - Local File Inclusion author: dwisiswant0 severity: medium...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

[SECURITY] Fedora 44 Update: httpd-2.4.69-1.fc44

The Apache HTTP Server is a powerful, efficient, and extensible web server...

[SECURITY] Fedora 44 Update: janus-1.4.2-1.fc44

Janus is an open source WebRTC server designed and developed by Meetecho...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

EUVD-2026-94154

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server , an authenticated user with permissions to modify roles can achieve privilege escalation . The vulnerability is caused by the improper validation of unsafe equivalence in inputs , allowing an attacker to weaken built-in roles and add their account to a priv...

study-CVE-2025-55182

Estudio de CVE-2025-55182 Repositorio para aprender sobre la vulnerabilidad de Remote Code Execution RCE en React Server Components. 🔴 Advertencia Úselo únicamente con fines educativos. Usarlo contra sistemas de terceros sin permiso es ilegal. 📋 Resumen de la vulnerabilidad Elemento| Contenido...

POC-CVE-2025-55182

Escáner de CVE-2025-55182 Herramienta sencilla de línea de comandos para detectar y explotar CVE-2025-55182 RCE en React Server Components en aplicaciones Next.js. Instalación chmod +x scanner.sh Uso Scan with default command id ./scanner.sh -d example.com Execute custom command ./scanner.sh -d...

NextChat_SSRF_CVE-2023-49785

NextChatSSRFCVE-2023-49785...

CVE-2025-55184

React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exis...

CVE-2025-55182

CVE-2025-55182 Autor original:https://github.com/msanft/CVE-2025-55182 Esta vulnerabilidad permite la ejecución remota de código RCE en las Server Functions de React, por ejemplo, las ofrecidas por Next.js a través de referencias inseguras al prototipo. No soy un experto en React o Next.js, así q...