CLEANSTART-2026-IV86887 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...

Security vulnerability affects the rundeck package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...

[SECURITY] Fedora 45 Update: ocaml-ounit-2.2.7-23.fc45

OUnit is a unit test framework for OCaml. It allows one to easily create unit-tests for OCaml code. It is loosely based on HUnit, a unit testing framework for Haskell. It is similar to JUnit, and other xUnit testing frameworks...

PT-2026-106809

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 2.32.2 Description The openURL utility in ui/src/utils/open-url/open-url.js incorrectly trusts window.SafariViewController in iOS environments. When components like QEditor, QSelect, or QChatMessage render...

PT-2026-106825

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 3.3.0 Description Several @quasar/app-vite Server-Side Rendering SSR and Static Site Generation SSG rendering paths interpolate the ssrContext.nonce variable directly into quoted HTML attributes. If an...

CVE-2026-106104: Inefficient Regular Expression Complexity

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

PT-2026-106824

Name of the Vulnerable Software and Affected Versions @quasar/render-ssr-error versions prior to 2.2.4 @quasar/app-vite versions prior to 3.3.0 Description The renderSSRError function in utils/render-ssr-error/src/index.js serializes process.env, request headers, and cookies into the HTTP page...

PT-2026-107270

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 2.2.4 Description The @backstage/plugin-techdocs-backend package contains improper authorization enforcement for static content. An authenticated user with access to one TechDocs documentation site can craft a URL t...

PT-2026-106810

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 2.22.0 Description The SSR-only getHead serializer in ui/src/plugins/meta/Meta.js uses getAttr to interpolate values provided via useMeta into title, meta, link, and script markup without proper HTML text or...

PT-2026-106822

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 2.23.3 Description In the Platform.parseSSR function within ui/src/plugins/platform/Platform.js, an unbounded User-Agent request header is passed to the getMatch function. The browser-detection expressions in...

React Router Vulnerable to Cross-Site Scripting (XSS) via Redirect Location Mishandling (CVE-2026-22029)

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...

Privilege Escalation / Access Control Bypass in Brocade Fabric OS Web Management Framework (CVE-2026-94575)

: A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for...

PT-2026-106463

Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...

perwendel__spark_CVE-2018-9159_2_7_2_fixed

Spark - um micro framework web para Java 8 Novidades : Spark 2.7.1 foi lançado. Experimente e reporte quaisquer bugs. com.sparkjava spark-core 2.7.1 Importante - Há uma vulnerabilidade em versões mais antigas do Spark versões anteriores à 2.5.2. Atualize para a versão mais recente. Para...

Log4Shell-PoC-Application

☕ Aplicação PoC Log4Shell Aplicação web baseada no framework Spring para prova de conceito de vulnerabilidades log4shell Instalação e Execução !Important JDK 1.88u131 em desenvolvimento é necessário para executar este projeto Use o Dockerfile fornecido para construir e executar a imagem Docker da...

pdfjs-vuln-demo

Projeto de Demonstração da Vulnerabilidade do PDF.js Este projeto destina-se a servir como uma prova de conceito para demonstrar a exploração da vulnerabilidade na biblioteca PDF.js pdfjs-dist reportada em CVE-2024-4367 Como Executar Faça um fork e clone este repositório npm install npm run dev...

CVE-2022-22965_Spring4Shell

CVE-2022-22965Spring4Shell CVE-2022-22965 Spring4Shell, SpringShell é uma vulnerabilidade no Spring Framework que utiliza a funcionalidade de data binding para vincular dados armazenados em uma requisição HTTP a determinados objetos usados por uma aplicação. O bug existe no método...

perwendel__spark_CVE-2018-9159_2-7-1

Spark - um pequeno framework web para Java 8 NOTÍCIAS : Spark 2.7.0 foi lançado. Por favor, teste e relate quaisquer bugs. com.sparkjava spark-core 2.7.0 Importante - Existe uma vulnerabilidade em versões antigas do Spark versões anteriores a 2.5.2. Por favor, atualize para a versão mais recente...

WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LevinityCyber in WordPress Plugin GDPR Framework By Data443 versions = 2.5.0...

CVE-2022-22965

CVE-2022-22965 Spring4Shell CVE-2022-22965 Uso 1. exibir informações ❯ go run main.go -s INF VulnInfo: "Name": "CVE-2022-22965", "VulID": "nil", "Version": "1.0", "Author": "", "VulDate": "2022-03-30", "References": "https://nosec.org/home/detail/4983.html" , "AppName": "Spring Core",...

CVE-2020-5398

CVE-2020-5398 - Ataque RFD Reflected File Download para Spring MVC No Spring Framework, versões 5.2.x anteriores a 5.2.3, versões 5.1.x anteriores a 5.1.13 e versões 5.0.x anteriores a 5.0.16, um aplicativo está vulnerável a um ataque de download de arquivo refletido RFD quando define um cabeçalh...