CVE-2026-92608

The Apache Qpid Broker-J software, versions through 10.1.0 , is vulnerable to a flaw involving improper handling of property-encoding exceptions during AMQP 1.0-to-AMQP 0-10 message conversion. This issue allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers by using m...

CVE-2026-92608 Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...

SpringBoot_Actuator_RCE

swagger-ui Interface /swagger-ui.html SpringBoot env: Obtaining Sensitive Information Masked with Part 1 When we directly visit the springboot site, we can see that some password fields are filled with 1. Plaintext fields can be obtained via $name 2. Misconfiguration leads to sensitive informatio...

CVE-2026-85417

Brocade SANnav versions prior to 3.0.1a are vulnerable to incomplete property masking within the logging subsystem. Under specific configuration conditions, this flaw allows SNMP authentication and privacy passwords to be recorded in plain text within application logs. Attackers with read access ...

CVE-2026-98148

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

UBUNTU-CVE-2026-98148

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

Linux Distros Unpatched Vulnerability : CVE-2026-98148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the devic...

CVE-2026-93234

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

CVE-2026-96758

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-59284

A flaw was found in Spring Cloud Commons. A remote attacker with high privileges could exploit a missing allow list for property keys in the writable /actuator/env endpoint. This vulnerability allows the attacker to modify environment properties, resulting in a high integrity impact and a low...

joern

Joern Query Database "Joern-Scan" This is the central query database for the open-source code analysis platform Joern. It has two purposes: It provides the batteries required to turn Joern into a ready-to-run code scanning tool. Its queries serve as examples useful for those looking to write thei...

CVE-2026-81882

A flaw was found in radare2. The binary property-list Unicode parser did not properly terminate strings, leading to an underallocation of memory. A local attacker could exploit this by providing specially crafted binary property-list data and executing specific commands pFB or pFBj. This could...

spring4shell-local-verification-lab

Spring4Shell Local Impact Condition Verification, Remediation, and Re-testing Project Project Introduction This project is used for learning and verifying the impact conditions, risk manifestations, remediation methods, and post-remediation re-testing procedures for Spring Framework CVE-2022-2296...

osiris

⬡ OSIRIS オープンソースインテリジェンス & 偵察統合システム リアルタイムのフライト追跡、CCTVネットワーク、地震モニタリング、紛争地域のマッピング、24時間365日のニュースフィードを単一のGPUアクセラレーションインターフェースに集約した、リアルタイムのグローバルインテリジェンスダッシュボード。 ライブデモ · バグ報告 · 機能リクエスト · Discordに参加 概要 Osirisは、複数のインテリジェンス領域にわたる状況認識を提供する本番グレードのOSINTプラットフォームです。Next.js 16とMapLibre...

CVE-2026-81882

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The...

UBUNTU-CVE-2026-81882

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The...

CVE-2026-81882

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The...

CVE-2026-81882: Out-of-bounds Read

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The...

Security Bulletin: IBM Optim 1.1.0 impacted by vulnerability in lodash-es 4.17.21

Summary IBM Optim 1.1.0 includes lodash-es 4.17.21 as an npm dependency in the archon-ui component. This version is affected by CVE-2025-13465, a prototype pollution vulnerability that allows a remote attacker to manipulate JavaScript object prototypes via specially crafted input, potentially...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...