EUVD-2026-78168

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

PT-2026-91743

Name of the Vulnerable Software and Affected Versions Activiti versions prior to 7.1.0.M7 Description Failure to validate hash-brace deferred expressions in process variables allows attackers to bypass expression filtering. By injecting expressions starting with , an attacker can store these...

PT-2024-21351 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Meta4 HR affected versions not specified Description: A vulnerability has been found that allows an attacker to obtain information about the application, including variables set in the process, Tomcat versions, library versions, and the...

SUSE CVE-2013-7108

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service crash via a long string in the last key value in...

B&r Automation APROL Security Breach

B&r Automation B&r Automation APROL is a Linux-based process control system for industrial control applications from Australian company B&r Automation. A security vulnerability exists in B&R Industrial Automation APROL versions prior to R4.2 V7.08, which originates from the ability to alter...

Update JBoss 308 & 321: Remote Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Adam, thanks for the question, here is the answer: just downloaded the 3.0.8 from Jboss.org and changed the port of the exploit code from 1701 to 1476, which is the HSQL port in Version 3.0.8 of JBoss. I can confirm that JBOSS 3.0.8 is also...