CVE-2026-66422

Apache Tomcat is affected by an Improper Authorization vulnerability caused by security-role-ref definitions being incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole(). This allows Servlet role references to bypass declarative role cons...

decker

Decker - Cadre d'orchestration de tests d'intrusion Objectif Decker est un cadre d'orchestration de tests d'intrusion. Il exploite HashiCorp Configuration Language 2 le même langage de configuration que Terraform pour permettre la déclaration de tests d'intrusion en tant que code, afin que vos...

wxpath

wxpath — декларативный обход веб-графа с помощью XPath НОВИНКА: TUI — интерактивный терминальный интерфейс на основе Textual для тестирования выражений wxpath и экспорта данных. Установка Требуется Python 3.10+. root@kitploit: pip install wxpath Для поддержки TUI: pip install "wxpathtui" Быстрый...

CertificateDsc

CertificateDsc Кодекс поведения Этот проект принял этот кодекс поведения. Релизы Для каждого слияния в ветку main предварительный релиз будет развёрнут в PowerShell Gallery. Периодически будет публиковаться тег версии релиза, который развернёт полный релиз в PowerShell Gallery. Участие в разработ...

crml

CRML — Язык моделирования киберрисков Cyber Risk Modeling Language Статус: Черновик. Этот проект находится в активной разработке и может изменяться без предварительного уведомления. Мы приветствуем замечания, вопросы и вклад. ⚠️ ВНИМАНИЕ Эта кодовая база в настоящее время разрабатывается в ветке...

SUSE CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-53666

A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering SSR, a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially...

EUVD-2026-49634

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-42211

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...

CVE-2026-33244

A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP Location header value. This can lead to Cross-Site Scripting XSS, allowing malicious scripts to be injected into statically generated HTML files if the...

CVE-2026-40181

A flaw was found in React Router. This vulnerability allows a remote attacker to redirect users to an external, potentially malicious, website. This occurs when specially crafted URLs, containing paths starting with //, are passed to the redirect function, causing them to be misinterpreted as...

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to insufficient CSRF checks for PUT, PATCH, and DELETE document requests. An attacker can cause unauthorized state changes by tricking a user into submitting crafted requests from another origin. Note...

GHSA-84G9-W2XQ-VCV6 React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...

RHEL 10 : qt6-qtdeclarative (RHSA-2026:24987)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:24987 advisory. Qt6 - QtDeclarative component. Security Fixes: qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file CVE-2025-14576 For more...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Qt Declarative vulnerability (USN-8357-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8357-1 advisory. It was discovered that Qt Declarative did not properly validate the width and height attributes of image tags in the Text component of Qt...

RHSA-2026:24987 Red Hat Security Advisory: qt6-qtdeclarative security update

Bulletin has no description...

Important: Red Hat Security Advisory: qt6-qtdeclarative security update

An update for qt6-qtdeclarative is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

GHSA-RXV8-25V2-QMQ8 React Router vulnerable to Denial of Service via reflected user input in single-fetch

A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0...

RLSA-2026:20567 Important: qt6-qtdeclarative security update

Qt6 - QtDeclarative component. Security Fixes: qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file CVE-2025-14576 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in...