procrustes

Procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked. The script currently supports sh, bash and powershell and is compatible with exec style command execution e.g...

Adobe AEM Dispatcher <4.15 - Rules Bypass

Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors. id: CVE-2016-0957 info: name: Adobe AEM Dispatcher 4.15 - Rules Bypass author: geeknik severity:...

open-klara

Open KLara Open KLara is a community-driven fork of KLara by Kaspersky Lab — a distributed system for scanning large malware collections with Yara rules. This project is maintained by the community and is not affiliated with Kaspersky Lab. Features Web Interface — Fire-and-forget Yara scans with...

NetworkManager security update

1.54.3-5.0.1 - Introduce always-ignore-carrier setting Orabug: 39663315 - disable MPTCP handling by default Orabug: 34801142 - add connectivity check via Oracle servers Orabug: 32051972 - Add a dropin file to make Networkmanager-dispatcher persistent Orabug: 36989910 - Drop 777 permissions from t...

EUVD-2026-62693

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21...

CVE-2026-19198

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher , allowing a low-privileged authenticated user to perform unauthorized bulk actions. The vulnerability is network-exploitable with low attack complexity and no user interaction, re...

CVE-2026-19198 Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21...

CVE-2026-19198 Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21...

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-75627

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

EUVD-2026-60578

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75627

Bastillion's controller dispatcher (BaseKontroller.java) fails to validate request URI paths, allowing unauthenticated attackers to bypass authentication filters by prefixing arbitrary path segments. This grants access to administrative controllers to read user listings, create manager accounts, ...

CVE-2026-73410

Budibase versions prior to 3.40.0 have a DNS-rebinding SSRF flaw in the REST datasource integration. The guard fetchWithBlacklist pins a validated IP via a Node http(s).Agent, but rest.ts routes requests through undici's fetch, which silently ignores the agent option and uses its own dispatcher t...

CVE-2026-73410 Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

CVE-2026-73410

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

CVE-2026-66147

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...