EUVD-2026-52694

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with ...

CVE-2026-67198

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Specifically, sending well-formed requests such as ViewToArrowReq wi...

CVE-2026-14930 JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions and attach them to...

CVE-2026-68502 LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get'value' to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.callcommand,...

AZL-94440 CVE-2026-15157 affecting package nodejs 24.18.1-1

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

The vulnerability of the Microsoft Windows operating system’s message queue dispatcher allows a hacker to execute arbitrary code.

The vulnerability of the message queue dispatcher in Microsoft Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-47690

MeltanoHub (hub.meltano.com) had a vulnerability in versions prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173, where a pull_request_target workflow could exfiltrate the repository GITHUB_TOKEN with write permissions. The issue was fixed by the commit 923820de8f64d753951fbbd54f7282a3d5f751...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-47394

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...

PYSEC-2026-1281 Crawl4AI SSRF vulnerability

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

CVE-2026-53000

In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfreercu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nfhookops that are used to register the callbacks. However,...

Exploit for Path Traversal in Microsoft

🛡️ NimbusPWN-CVE-2022-29799-29800 - Test local privilege escal...

Exploit for Path Traversal in Microsoft

NimbusPwn — networkd-dispatcher...

CVE-2026-0082

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-37223

FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert. A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp...

CVE-2026-8780

A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is publicly availabl...

CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

CVE-2026-4365

The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the deletequestionanswer function in all versions up to, and including, 4.3.2.8. The plugin exposes a wprest nonce in public frontend HTML lpData to unauthenticated visitors, and...

CVE-2026-37223

FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert. A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp...