30405 matches found
CVE-2025-71408
The CVE-2025-71408 issue affects NLTK up to version 3.9.2 (pre-3.9.3). The vulnerability lies in nltk.collocations’ main path, where command‑line arguments are passed directly to eval() to form BigramAssocMeasures suffixes without a allowlist or sanitization, enabling an attacker who can control ...
CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments
NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...
CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments
NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...
GO-2026-5569 Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo
Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo...
Information Exposure
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via error messages generated during GraphQL validation and input-coercion. An attacker can obtain...
CVE-2026-66009
Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...
yakit v1.4.8-0724
YAKIT-A Cyber Security ALL-IN-ONE Platform based on Yak language Whitepaper • Official documentation • Issue feedback • Official website • Community • Architecture :book:Language： English • 中文 Introduction Security integration is a reform of security operations and management for enterprises in t...
CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...
vulnerability-scanner
Web Application Vulnerability Scanner A beginner-friendly Pyt...
OESA-2026-3145 perl security update
Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: Perl versions through 5.43.9 produce...
SUSE CVE-2026-39879
Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...
[SECURITY] Fedora 44 Update: python-lsp-black-2.0.0-17.fc44
lsp-black is a python-lsp-server plugin that adds support to black autoformatter. This is forked from pyls-black to be compatible wth community maintained language-server python-lsp-server...
semgrep v1.171.0
Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...
Xalgorix Autonomous AI Pentesting Agent 4.5.72
Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...
Transforming Keystroke Noise to Text: Self-Supervised Acoustic Eavesdropping Attacks on Keyboards
We present a self-supervised acoustic eavesdropping attack that reconstructs typed text solely from keystroke sounds, without requiring labeled data for the target device. The proposed attack enables stealthy eavesdropping in two real-world scenarios-physical spaces public and semi-public and...
Joern 4.0.583
Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...
PoCEvolve: Generating Proof-Of-Concept Exploits from Security Patches with Vulnerability-Aware Prompt Evolution
Ideally, the detailed information about a vulnerability should be made available together with the fixing commit. In practice, however, such details often become available only long after the commit, even when a CVE has already been published. During this window, the patch is already public, so...
The vulnerability of the Oracle WebLogic Server application server’s kernel allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the Oracle WebLogic Server application server’s kernel is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information using the SAML protoc...
The vulnerability of the JQ programming language, related to uncontrolled recursion, allows attackers to trigger a service failure.
The vulnerability of the JQ programming language lies in its uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...
