CVE-2026-11796

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific function...

CVE-2026-11796

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific function...

CVE-2026-11796

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific function...

CVE-2026-11796

The Asset Suite application contains a vulnerability that allows unauthenticated users to access specific servlets, including PropertiesReloadServlet , CacheFlushServlet , MetadataCacheFlushServlet , and ResourceBundleReloadServlet . These servlets are intended for specific production functions b...

EUVD-2026-88692

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific function...

EUVD-2026-88691

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production...

CVE-2026-7395

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production...

CVE-2026-7395

The Asset Suite software contains a vulnerability allowing unauthenticated users to access the HTTPPublishAdapterTestServlet . This component, intended strictly for testing in non-production environments, can be exploited to perform configuration file uploads . Successful exploitation may lead to...

CVE-2026-7395

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production...

Custom-Nuclei-Templates

Custom Nuclei Templates This collection of Nuclei templates is designed to enhance your security testing capabilities. Made a few custom templates and i might add more as time goes on. Introduction Nuclei is a powerful tool for fast and customizable vulnerability scanning. This repository contain...

EUVD-2026-88560

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...

CVE-2026-7395: Missing Authentication for Critical Function

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production...

CVE-2026-11796: Missing Authentication for Critical Function

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific function...

PT-2026-102472

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production...

CVE-2026-101092 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...

MAL-2026-17224 Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

CVE-2026-101092: Exposure of Sensitive Information to an Unauthorized Actor

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...

CVE-2026-100577

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100577

OpenClaw versions prior to 2026.8.1 are vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from a failure to validate video asset URLs returned by providers. A malicious or compromised provider can provide private or loopback URLs , forcing the OpenClaw CLI to make unauthorized ...