EUVD-2026-52972

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...

CVE-2026-67979

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...

PT-2026-67811

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise contains an Insecure Direct Object Reference IDOR where the openai-assistants-vector-store endpoints accept a client-controlled credential parameter. The system loads credentials by id and us...

jmespath.rb Memory Leak DoS

The vulnerability of the library for querying and filtering JSON data, jmespath.rb, is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker who operates remotely to cause service failures...

AngularJS Prototype Attribute Uncontrolled Data Compromise

The vulnerability of the JavaScript framework AngularJS is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of data...

RHEL 8 : thunderbird (RHSA-2026:49922)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49922 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

CVE-2026-67321

A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This ca...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

EUVD-2026-52294

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18642

CVE-2026-18642 describes a deserialization of untrusted data vulnerability in TÜBİTAK BİLGEM’s eta-otp-lock (affected: before 1.0.4) that may enable Object Injection. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL attack vector, NO privileges required, but USER INTERACTION is required; confiden...

EUVD-2026-52287

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094

Admidio before 5.0.11 is affected by CVE-2026-69094: an insecure direct object reference in the save_temporary mode of mylist_function.php allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users’ p...

Exploit for Link Following in Microsoft

CVE-2023-36874 Proof of Concept PoC An educational and defe...

firefox: thunderbird: Privilege escalation in the DOM: Content Processes component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Content Processes component...

firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the DOM: Bindings WebIDL component...