Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libxml2 vulnerabilities (USN-8910-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8910-1 advisory. Yirou Yang discovered that libxml2 incorrectly handled certain XML catalogs. If a...

CVE-2026-109280

A flaw was found in ImageMagick. A local attacker can cause a Denial of Service DoS or memory corruption by providing crafted -fx expressions under low-memory conditions. When a memory allocation fails during expression processing, the application accesses previously freed memory, leading to an...

UBUNTU-CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

Important: pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular...

CVE-2026-27876

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write to RCE CVSS 9.1 Critical | Arbitrary File Write | Remote Code Execution Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Summary Grafana's SQL Expressions feature sqlExpressions toggle uses an...

CVE-2024-9264

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

log4j2-CVE-2021-45105

Sample Log4j2 vulnerable application CVE-2021-45105 Versions Affected: all versions from 2.0-beta9 to 2.16.0 This application is based on Spring Boot web application vulnerable to CVE-2021-45105 It uses Log4j 2.16.0 Running the application Run it: Import the project in Java IDE as a maven project...

CVE-2026-27876

🚨 CVE-2026-27876 - Grafana Critical RCE via SQL Expressions A chained vulnerability allowing arbitrary file writes through SQL Expressions, leading to full Remote Code Execution RCE on the host. 📋 Overview CVE ID : CVE-2026-27876 Severity : Critical CVSS v3.1: 9.1 Published : March 27, 2026 CWE :...

CVE-2018-11776-FIS

CVE-2018-11776 is a security vulnerability in Apache Struts, a popular framework for developing web applications. This vulnerability allows attackers to carry out remote attacks by injecting malicious code into data fields of HTTP requests. This vulnerability has been widely exploited in...

EUVD-2026-96373

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108586

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108586 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

EUVD-2026-96347

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108553 OpenRefine through 3.10.1 CSRF to RCE via get-rows Command

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108553

OpenRefine versions through 3.10.1 are vulnerable to a Cross-Site Request Forgery (CSRF) in the get-rows command . This flaw allows a remote attacker to trick a user into visiting a malicious page that issues a cross-origin GET request with a crafted engine parameter . Successful exploitation ena...

cyberchef-recipes

CyberChef is the self-purported 'Cyber Swiss-Army Knife' created by GCHQ. It's a fantastic tool for data transformation, extraction & manipulation in your web-browser. Full credit to @GCHQ for producing the tool. See: https://gchq.github.io/CyberChef/ General Tips Download CyberChef and run it...

CVE-2024-9264

CVE-2024-9264 - PoC de LFI/RCE en Grafana SQL Expressions DuckDB Prueba de concepto en Python para CVE-2024-9264, una vulnerabilidad de Grafana SQL Expressions que puede permitir la inclusión autenticada de archivos locales y la ejecución de comandos cuando duckdb está disponible en el PATH del...

PT-2026-109667

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.10.2 Description A cross-site request forgery CSRF flaw exists in the get-rows command. This issue allows remote attackers to lure a user to a malicious page that issues a cross-origin GET request with a crafted...