CVE-2026-9291

Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results. We recommend you upgrade to...

CVE-2026-42685

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1...

CVE-2026-40901

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

CVE-2026-45776: Improper Access Control

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logic allows an attacker to submit a crafted HTTPS POST request that sets a session variable used for authorization decisions. If an installation of Open XDMoD...

PT-2026-47037

Name of the Vulnerable Software and Affected Versions OpenXDMoD versions prior to 11.0.3 Description A flaw in the access control logic allows an attacker to submit a crafted HTTPS POST request to set a session variable used for authorization decisions. In installations including the optional Job...

com.aizuda:snail-job-client-common (1.7.2), com.aizuda:snail-job-client-job-core (1.7.2) +34 more potentially affected by CVE-2026-50076 via org.apache.fory:fory-core (0.11.2)

org.apache.fory:fory-core MAVEN version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.fory:fory-core and may be impacted: - com.aizuda:snail-job-client-common 1.7.2 - com.aizuda:snail-job-client-job-core 1.7.2 -...

com.aizuda:snail-job-client-common (>=1.8.0-beta1, <=1.8.0-jdk8), com.aizuda:snail-job-client-job-core (>=1.8.0-beta1, <=1.8.0-jdk8) +33 more potentially affected by CVE-2026-50076 via org.apache.fory:fory-core (0.12.1)

org.apache.fory:fory-core MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.fory:fory-core and may be impacted: - com.aizuda:snail-job-client-common =1.8.0-beta1, =1.8.0-beta1, =1.8.0-beta1, =1.8.0-beta1, =1.8.0-beta1,...

com.aizuda:snail-job-client-common (>=1.8.1, <=2.0.2), com.aizuda:snail-job-client-job-core (>=1.8.1, <=2.0.2) +41 more potentially affected by CVE-2026-50076 via org.apache.fory:fory-core (0.13.0)

org.apache.fory:fory-core MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.fory:fory-core and may be impacted: - com.aizuda:snail-job-client-common =1.8.1, =1.8.1, =1.8.1, =1.8.1, =1.8.1, =1.8.1, =1.8.1, =1.8.1, =1.8.1,...

Exploit for Deserialization of Untrusted Data in Presstigers Simple_Job_Board

CVE-2024-1813 - Simple Job Board ≤ 2.11.0 WordPress - Unauth...

CVE-2019-25740

Joomla comjsjobs 1.2.6 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating custom userfield parameters. Attackers can send POST requests to the job.savejob task with path traversal sequences in the field2 parameter to delete...

CVE-2019-25740

Joomla comjsjobs 1.2.6 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating custom userfield parameters. Attackers can send POST requests to the job.savejob task with path traversal sequences in the field2 parameter to delete...

Five Eyes Warns Chinese Spies Are Using Fake Job Ads to Target Military Staff

Five Eyes warns that Chinese spies are using fake job ads on LinkedIn, Indeed, and Upwork to target military staff and steal sensitive data...

CVE-2026-41010

The CVE describes a shell command-injection in BOSH Director during ReleaseJob#unpack: the code constructs a shell command using a name value taken verbatim from attacker-supplied release.MF and interpolates it into tar -C … -xf …, then executes via /bin/sh -c. Although the directory is created w...

CVE-2026-41010

ReleaseJobunpack builds jobdir = File.join@releasedir, 'jobs', name and jobtgz = File.join@releasedir, 'jobs', "name.tgz" where name returns @jobmeta'name', a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolat...

CVE-2026-41010

ReleaseJobunpack builds jobdir = File.join@releasedir, 'jobs', name and jobtgz = File.join@releasedir, 'jobs', "name.tgz" where name returns @jobmeta'name', a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolat...

EUVD-2026-34198

ReleaseJobunpack builds jobdir = File.join@releasedir, 'jobs', name and jobtgz = File.join@releasedir, 'jobs', "name.tgz" where name returns @jobmeta'name', a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolat...

PT-2026-46136

Name of the Vulnerable Software and Affected Versions BOSH Director versions prior to 282.1.12 Description The ReleaseJobunpack function constructs file paths using the name variable, which is retrieved from the jobs: array within an attacker-supplied release.MF file inside an uploaded tarball...

Cloud Foundry BOSH Director security vulnerabilities

Cloud Foundry BOSH Director is a cloud infrastructure deployment and lifecycle management platform developed by the US Cloud Foundry company. All versions of Cloud Foundry BOSH Director, as well as previous versions, have security vulnerabilities. These vulnerabilities stem from the use of the na...

samba: Samba: Remote Code Execution in printing subsystem via unescaped job description

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by...

`logflux` was removed from crates.io for malicious code

The logflux crate attempted to download and run a malicious payload on the user's machine. The malicious crate had 1 version published on 2026-04-26, approximately 1 month before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Paweł Bis for...