CVE-2026-71324

A flaw was found in Traefik. Traefik's HTTP reverse proxy can improperly handle HTTP/2 or HTTP/3 CONNECT requests forwarded to an HTTP/1.1 upstream. If the upstream sends a keep-alive non-2xx response and does not fully drain the body, the desynchronized backend socket is returned to a shared poo...

CVE-2026-62384

A flaw was found in NLTK. The FramenetCorpusReader component is vulnerable to a symlink-based sandbox bypass. An attacker can exploit this by placing specially crafted symbolic links within a corpus subdirectory. These symlinks bypass path validation, allowing the attacker to read arbitrary XML...

CVE-2020-36287

CVE-2020-36287 La risorsa delle preferenze dei gadget della dashboard del plugin Atlassian gadgets utilizzato in Jira Server e Jira Data Center prima della versione 8.13.5, e dalla versione 8.14.0 prima della versione 8.15.1, consente a remoti attaccanti anonimi di ottenere le impostazioni relati...

CVE-2026-62902

A flaw was found in .NET. This vulnerability allows an unauthorized attacker to disclose sensitive information over a network. The issue arises from the inclusion of functionality from an untrusted control sphere, which can be exploited to reveal data. Mitigation No mitigation is needed. All...

CVE-2026-72848

A flaw was found in langchain-community. An attacker who controls or influences an ingested sitemap can bypass domain restrictions in the SitemapLoader component by pointing a nested sitemap entry at an internal address. This allows the server to fetch internal resources even when...

react

Dump di dati dagli internals di React Questo strumento è uno userscript rapido e sporco per Tampermonkey che scava un paio di livelli in qualsiasi pagina React e cerca una o più frasi fornite dall'utente. Lo strumento rende facile trovare il punto giusto nel DOM in cui React collega grandi blocch...

CVE-2026-49825

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CVE-2026-76227

A flaw was found in Renovate. The application fails to restrict environment variables when it creates new child processes. This oversight allows these child processes, such as those used for package installation or post-upgrade tasks, to access all environment variables of the main Renovate...

CVE-2019-25766

A flaw was found in Renovate. During certain Go Modules update failure scenarios, temporary repository tokens are inadvertently leaked into pull request comments. A remote attacker able to view these comments could obtain the exposed tokens, leading to unauthorized access to repositories. This...

assertj-core security update

An update is available for assertj-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A rich and intuitive set of strongly-typed assertions to use for unit...

CVE-2026-81672

CVE-2026-81672 is a SQL injection vulnerability in TOOOLS' iSquad , affecting the /ws/apiprensa/getVideoSubcanal endpoint. The root cause is improper handling of the id_video parameter: the application does not sanitize input before constructing SQL queries, leading to execution errors with malic...

CVE-2026-81672 Multiple Vulnerabilities in TOOOLS' iSquad

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...

EUVD-2026-67005

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...

CVE-2026-75838

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CVE-2026-72814

A flaw was found in actix-files. When a non-existing folder is provided as the servefrom argument to Files::new, the service incorrectly resolves request paths as relative to the application's working directory. This allows an attacker to access unintended files, leading to information disclosure...

CVE-2026-73646

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

CVE-2020-35391-POC

Benvenuto in CVE-2020-35391-POC 👋 Tenda N300 Bypass dell'autenticazione tramite header di richiesta HTTP malformato - POC in Python I dispositivi Tenda N300 F3 12.01.01.48 consentono ad attaccanti remoti di ottenere informazioni sensibili tra cui possibilmente una riga httppasswd tramite una...

CVE-2026-80578

A flaw was found in the Linux kernel's fbdev core. A local user could trigger an out-of-bounds read vulnerability in the fbioread function. This occurs due to a pointer desynchronization when handling partial copies from a faulty user buffer, allowing the system to read beyond intended memory...

CVE-2026-19632

كشف رابط إعادة تعيين كلمة المرور في TranslatePress إلى الاستيلاء الكامل على حساب المسؤول CVE: CVE-2026-19632 | CVSS: 9.8 حرج استيلاء غير مصادق عليه على الحساب عبر إضافة TranslatePress لووردبريس. الوقت من نشر CVE إلى PoC يعمل في اليوم الأول: 5 ساعات، 9 دقائق، 40 ثانية حتى الإصدار 3.3.1 وما قبله؛ ت...

CVE-2025-25964

CVE-2025-25964: SQL Injection in School Information Management System v1.0 Introduzione Nel panorama digitale odierno, l'SQL Injection SQLi rimane una delle vulnerabilità più comuni e pericolose nelle applicazioni web. Questo post del blog discute una vulnerabilità critica di SQL Injection...