Security Bulletin:Vulnerabilities exists in NPS of IBM Netezza Appliance

Summary Vulnerabilities identified in NPS of IBM Netezza Appliance have been addressed in version 11.3.1.3-IF3. Vulnerability Details CVEID:CVE-2026-13204 DESCRIPTION: If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of...

Gradio - Open Redirect

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

OpenCATS - Open Redirect

OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations. id: CVE-2023-27292 info: name:...

webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy

A flaw was found in WebKitGTK. Processing malicious web content can violate the iframe sandboxing policy due to improper validation...

webkitgtk: Visiting a maliciously crafted website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a malicious website may lead to a sensitive data leak due to improper validation checks...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper validation checks...

cve-2018-12798

Adobe Acrobat Reader Heap Overflow Remote Code Execution Vulnerability Vulnerability Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Vulnerability Description This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of...

CVE-2025-25279

Security Advisory MMSA-2025-00430 / CVE-2025-25279 Summary After uploading a file to Mattermost Boards, when the fileId parameter is modified and the board is copied, the file now points to and downloads the target file specified in the parameter. Affected Versions: Mattermost instances with Boar...

CVE-2025-50944

CVE-2025-50944 Improper Certificate Chain Validation in EagleEyes Lite Android Application 1. Overview Name : EagleEyesLite Version : 2.0.0 Vendor : AVTECH CWE : CWE-295: Improper Certificate Validation CVSS : 8.8 HIGH Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 2. Summary...

kkFileView 4.0 - Server-Side Request Forgery

kkFileView 4.0 contains a server-side request forgery caused by improper validation in OnlinePreviewController.java, letting attackers induce the server to make arbitrary requests, exploit requires sending crafted requests. id: CVE-2022-42149 info: name: kkFileView 4.0 - Server-Side Request Forge...

CVE-2026-22444

CVE-2026-22444 Apache Solr UNC Path Validation Vulnerability Overview CVE-2026-22444 is a security vulnerability affecting Apache Solr, publicly disclosed around January 20, 2026. The vulnerability stems from insufficient input validation CWE-20: Improper Input Validation on certain API parameter...

CVE-2019-10149

CVE-2019-10149 CVE-2019-10149 : A flaw was found in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution. Example nc -lvp 9000 python ./CVE-2019-10149/exploit.py --rhost example.com --rport...

CVE-2021-24762

Overview This repository documents the detection of CVE-2021-24762, a vulnerability identified on a WordPress instance through HTTP scanning. The vulnerability was discovered on the WordPress AJAX endpoint: /wp-admin/admin-ajax.php This endpoint is commonly used by WordPress plugins and themes to...

CVE-2026-51954

Product: Webasyst Framework Affected Version: ≤ 4.0.3 Severity: High CVSS 3.1: 8.0 Description Webasyst Framework through 4.0.3 contains an OAuth 2.0 implementation flaw that allows a remote, unauthenticated attacker to intercept authorization credentials issued during the OAuth flow, without...

EEF-CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Summary Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text befo...

CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...

CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...

CVE-2026-117666

The deadtrickster ssl_verify_fun library (versions 1.0.1 to 1.1.8 ) contains an Improper Validation of Certificate with Host Mismatch vulnerability. The root cause is in the try_match_wildcard/4 function within src/ssl_verify_hostname.erl, which incorrectly anchors text around a wildcard, allowin...

day01-sessionreaper-lab

Day 1 — SessionReaper-style Vulnerable Lab Educational This is a tiny lab that simulates the core idea reported for CVE-2025-54236 “SessionReaper”: improper validation of nested JSON leading to dangerous code paths. This is not Magento/Adobe Commerce; it's a minimal educational replica to practic...

CVE-2026-118778

A flaw was found in node-forge. The Transport Layer Security TLS client improperly validates whether a server certificate was provided during the handshake. A malicious server or an on-path attacker can exploit this flaw by omitting the certificate message, triggering an uncaught exception that...