CLEANSTART-2026-LB53139 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

CVE-2026-84890 affects multiple packages. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. See references for individual vulnerability details...

CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding

Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...

CLEANSTART-2026-AF46685 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

CVE-2026-10050 affects multiple packages. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. See references for individual vulnerability details...

PT-2026-107785

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI products - 1 EDB PGAI AI Factory with IBM 1.3.0, 2 EDB PGAI Analytics Accelerator 1.3.0, and 3 EDB PGAI Hybrid Data Management 1.3.0. The vulnerabilities have been addressed in 1.4.1 version. Hence, IBM strongly recommends upgrading to 1.4.1...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

CVE-2024-21762

CVE-2024-21762 - Инструмент обнаружения и эксплуатации RCE в FortiGate SSL VPN Инструмент для обнаружения и эксплуатации CVE-2024-21762 – критической уязвимости в FortiGate SSL VPN ⚠️ ПРАВОВОЕ ПРЕДУПРЕЖДЕНИЕ : Данный инструмент предназначен исключительно для использования в авторизованных тестовых...

CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2023-25581

이 Python 스크립트는 pac4j-core의 CVE-2023-25581 취약점 악용을 보여줍니다. 이 취약점은 공격자가 악의적으로 조작된 Base64 인코딩 데이터를 역직렬화하여 임의 코드 실행RCE을 가능하게 합니다. 사전 요구 사항 스크립트를 실행하기 전에 다음이 설치되어 있는지 확인하십시오: Python 3.x : Python 다운로드 requests 라이브러리 : 다음 명령어로 설치합니다: pip install requests 사용법 리포지토리 클론: 이 리포지토리를 로컬 머신에 클론합니다: git clone...

BIT-APACHE-2026-63718 Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...

CVE-2026-105241

A flaw was found in Apache log4net. An attacker who can supply data that is recorded in system logs can submit unencodable Unicode characters, triggering an encoding error in the SmtpPickupDirAppender component. When this failure occurs, the application discards all buffered log messages in the...

CVE-2013-2028_Checker

CVE-2013-2028 - Nginx HTTP Server 1.3.9-1.4.0 청크 인코딩 스택 버퍼 오버플로우 설명 nginx 1.3.91.4.0의 http/ngxhttpparse.c에 있는 ngxhttpparsechunked 함수는 원격 공격자가 큰 청크 크기의 chunked Transfer-Encoding 요청을 통해 서비스 거부크래시 및 임의 코드 실행을 유발할 수 있게 하며, 이는 정수 부호 오류 및 스택 기반 버퍼 오버플로우를 트리거합니다. 예시 $ python3 nginxcve20132028checker.py...

CVE-2025-65300

CVE-2025-65300 설명 CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform 공개 날짜: 2025-10-28 마지막 업데이트: 2025-10-28 보고자: Phisit Pupiw 공급업체: Coohom CWE: CWE-79 – Cross-Site Scripting 요약 Coohom SaaS 플랫폼의 계정 설정 → 프로필 → 주소 모듈에서 저장형 교차 사이트 스크립팅XSS 취약점이 확인되었습니다. 사용자가 제공한 입력값이...

GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read

GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or...

CVE-2025-63588

CVE-2025-63588 CMSimpleXH cmsimplexh 경로 처리에서의 반사형 크로스 사이트 스크립팅 XSS 추정 CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medium 할당된 CVE: CVE-2025-63588 제품: CMSimpleXH - 1.8 공급업체: CMSimpleXH - https://www.cmsimple-xh.org/ 요약 CMSimpleXH 프론트 라우터 파싱 코드에서 동적 로그인 관련 입력을 처리하는 부분에 반사형 크로스 사이트 스크립팅XSS...

CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSys...

PT-2026-107569

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-105241

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupD...

DEBIAN-CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whos...