XWiki Platform - Remote Code Execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document SkinsCode.XWikiSkinsSheet leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute...

ServiceNow - Incomplete Input Validation

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addresse...

Google Chrome Microsoft Edge DoS

The vulnerability in the Platform component of Google Chrome and Microsoft Edge web browsers is related to use-after-free memory usage. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Transactions Platform Component Access Protected Information

The vulnerability in the Transactions Platform component of Google Chrome and Microsoft Edge web browsers is related to information disclosure. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

PT-2026-123298

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a val...

RHEL 9 : Red Hat OpenStack Platform 17.1 security advisory (Important) (RHSA-2026:90329)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90329 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

CreditNirvana Collections Platform authorization issue vulnerability

Versions prior to 4.8.2 of the CreditNirvana Collections Platform contain an authorization issue vulnerability. This vulnerability stems from improper authentication and authorization controls within the platform’s login service. Unauthenticated remote attackers can manipulate authentication...

CVE-2025-32429

CVE-2025-32429 XWiki SQL Injection PoC Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 Vulnerability: Blind SQL Injection in XWiki LiveData REST API Affected File: getdeleteddocuments.vm sort parameter Description : A blind SQL Injection vulnerability exists in XWiki Platform’s...

Mirage

Mirage OSINT Platform Mirage is an open-source intelligence OSINT platform built as a microservice architecture. It provides a scalable and extensible framework for collecting, analyzing, and visualizing intelligence data from various sources. Architecture Mirage is built using a microservice...

tink

Tink NOTE : Tink moved to github.com/tink-crypto and this repo is no longer active! As planned, we have split Tink into multiple GitHub repositories that are hosted at github.com/tink-crypto. As a consequence, we made this repository read-only and it is not going to be maintained moving forward. ...

Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

Parse Platform Parse Server information disclosure vulnerability

Versions prior to Parse Platform Parse Server 8.6.103 and versions from 9.0.0 through 9.10.5-alpha.4 contain an information disclosure vulnerability. This vulnerability arises because LiveQuery’s subscription hash fails to respect constraints surrounding the $or operator, including the Session...

Parse Platform Parse Server input validation error vulnerability

Versions prior to Parse Platform Parse Server 8.6.100 and versions from 9.0.0 through 9.10.4-alpha.3 contain an input validation error vulnerability. This vulnerability arises from the failure to reject writes to reserved internal field names within client objects; as a result, clients can store ...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.101 and versions from 9.0.0 up to 9.10.4-alpha.4 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in MongoDB deployments. Unauthenticated attackers can send delete requests to the internal...

Sourcetrail

Sourcetrail Important Note: This project was archived by the original autors and maintainers of Sourcetrail by the end of 2021. If you want to know more about this decision, read more on our blog. Sourcetrail is a free and open-source cross-platform source explorer that helps you get productive o...

CVE-2026-116018

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of...

CVE-2026-116018 ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of...

CVE-2026-116018 ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of...

EUVD-2026-109276

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of...

CVE-2026-116018

The ONEARMY community-platform (versions before 2.165.2 ) contains an insecure direct object reference (IDOR) vulnerability in the notification read endpoint. Authenticated users can exploit this via POST /api/notifications/:id/read to mark other users' notifications as read. By iterating through...