44784 matches found
EUVD-2026-67094
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...
CVE-2026-59280
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...
CVE-2026-59280
Applications utilizing Spring Framework 's FreeMarker integration may be susceptible to a path traversal attack. The vulnerability occurs when a controller returns a view name derived from untrusted input while FreeMarker is configured to resolve templates via SpringTemplateLoader . A remote atta...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
EUVD-2026-67081
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988
CVE-2026-79988 affects Craft CMS , where the Twig sandbox mechanism is misconfigured to allow dangerous functionality from the Yii framework , enabling authenticated remote code execution (RCE) . The vulnerability is rated CVSS 8.7 (HIGH) with a low complexity, network-based attack vector requiri...
CVE-2026-79988
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-81672
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...
Security Bulletin: Multiple security vulnerabilities identified in Spring Framework version shipped with IBM Guardium Cryptography Manager (GCM)
Summary Security vulnerabilities identified in Spring Framework shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static...
msf-commander
⚔️ MSF Commander v4.0 Complete Offensive Security Arsenal...
EUVD-2026-67005
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...
CVE-2026-81672
CVE-2026-81672 is a SQL injection vulnerability in TOOOLS' iSquad , affecting the /ws/apiprensa/getVideoSubcanal endpoint. The root cause is improper handling of the id_video parameter: the application does not sanitize input before constructing SQL queries, leading to execution errors with malic...
CVE-2026-81672 Multiple Vulnerabilities in TOOOLS' iSquad
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...
CLSA-2026-1787823679 TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.39-tuxcare.20...
[SECURITY] [DSA 6473-1] libdbi-perl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6473-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 27, 2026 https://www.debian.org/security/faq -...
GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal , during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and...