54971 matches found
PT-2026-76175
Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is define...
PT-2026-76172
Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...
PT-2026-76177
Issue summary: The CMS decrypt and PKCS7 decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use th...
PT-2026-67232
Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 1.0.12 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 2.0.12...
VulnCheck KEV: CVE-2026-38992
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator...
thm_ctf
🦊 TryHackMe / CTF Writeups Hands-on writeups from my TryHackM...
OESA-2026-3188 python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0, whe...
Improper Authentication
Overview feehi/cms is a Feehi CMS project template. Affected versions of this package are vulnerable to Improper Authentication in the Session management module, authentication logic, and logout handler components. An attacker can gain unauthorized access or escalate privileges by exploiting...
CVE-2026-53607
creationtimestamp| type| source ---|---|--- 2026-07-31 22:35:07+00:00| published-proof-of-concept| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-34pj-2622-jvxq...
EUVD-2026-36590
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass...
SUSE-SU-2026:3443-1 Security update for openssl-1_0_0
This update for openssl-100 fixes the following issue: - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678...
CVE-2026-57232
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...
Exploit-CMS-made-simple
Exploit-CMS-made-simple Ele explora uma vulnerabilidade sqli d...
CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...
CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...
CVE-2026-57232
CVE-2026-57232 affects Contao core-bundle's Feed Reader module. From versions 5.3.35–5.3.47 and 5.7.0-RC1–5.7.8, FeedReaderController::getResponse() passes feed URLs directly to the HTTP client via feedIo->read() without validating schemes or private addresses, enabling a backend user with mod...
JLSEC-2026-1084 CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...
CMS Cryptographic Message Syntax parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182...
PT-2026-66863
Name of the Vulnerable Software and Affected Versions FeehiCMS version 2.1.1 Description An issue exists in the Session management module, authentication logic, and logout handler components that allows an attacker to escalate privileges. Recommendations At the moment, there is no information abo...
Camaleon CMS (2.1.1 to 2.9.1) contains an authenticated RCE vulnerability
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution RCE vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...