CLEANSTART-2026-PP64708 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153...

CLEANSTART-2026-ZU18134 Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

Security vulnerability affects the sonarqube package. Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153...

PT-2026-107102

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

Arbitrary file manipulation vulnerability exists in the Brocade Fabric OS WebTools management

: An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file...

ROS-20261006-73-0364

The vulnerability of the rdsibgetmr function in the net/rds/ibrdma.c module, which implements kernel networking functions in the Linux operating system, is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20261006-73-0354

The vulnerability of the flowchange function in the net/sched/clsflow.c module of the net/sched subsystem of the Linux operating system’s kernel is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20261006-73-0352

The vulnerability of the fwchange function in the net/sched/clsfw.c module of the network scheduling subsystem of the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-106512: Improper Neutralization of CRLF Sequences in HTTP Headers

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2026-106037: Missing Authentication for Critical Function

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/removeall and /api/mount to read cached KV data with user...

CVE-2026-94270: Improper Authentication

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...

ROS-20261006-73-0038

The vulnerability of the meshmatcheslocal function in the net/mac80211/mesh.c module of the mac80211 stack implementation in Linux’s Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-97275

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation

A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS...

CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

EUVD-2026-92589

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-97275

The VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin (versions n/a through 1.0.28 ) is vulnerable to Improper Validation of Specified Quantity in Input (CWE-1284). This flaw allows for Input Data Manipulation , which can be used to bypass intended logic within the ...

EUVD-2026-92489

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

Spring4Shell RCE (CVE-2022-22965)

Exploits CVE-2022-22965 Spring Framework classLoader parameter binding to write a JSP webshell via Tomcat access log manipulation, then executes the configured reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring4Shell parameter binding RCE CVE-2022-22965.""" import random...

hlf-time-oracle

hlf-time-oracle hlf-time-oracle è un chaincode per la blockchain Hyperledger Fabric che fornisce l'ora esatta ad altri chaincode. hlf-time-oracle si basa sul pacchetto ntp e sul pacchetto nts. Risolve così il problema di sicurezza associato alla possibile manipolazione del tempo di transazione da...