CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423

Casdoor versions up to 4.0.0 are affected by a missing authentication vulnerability in the upload-resource API , specifically in the controllers/resource.go file. The flaw allows a remote, unauthenticated attacker to perform an arbitrary file upload via the upload-resource endpoint. The exploit h...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-169)

Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user...

Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged...

CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...

CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...

CVE-2025-12748

CVE-2025-12748 Eng Rus Credit: Svyatoslav Tereshin @TERESH1, Artem Mukhin @saladosss Issues: 687, 825 English Description An issue was discovered in the XML file processing procedure. The processing of the file's content is performed before the ACL check. This allows a user with limited permissio...

CVE-2026-84310

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/doccommon.py getoutline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths becaus...

DEBIAN-CVE-2026-84310

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/doccommon.py getoutline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths becaus...

CVE-2026-73764

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of...

CVE-2026-84310

A flaw was found in pypdf. A remote attacker could craft a malicious PDF document with specially designed outlines. Processing this document would cause the pypdf library to consume excessive processing time and memory, leading to a Denial of Service DoS condition. This vulnerability is due to a...

CVE-2025-3500-Poc

Lab: CVE-2025-3500 - Integer Overflow in Avast Antivirus Privilege Escalation Download Download Lab ZIP : https://github.com/chicken3962/CVE-2025-3500-Poc/releases/download/Release/cve-2025-3500.zip 🚀 Overview This repository provides a lab environment for researching CVE-2025-3500, an integer...

jira-ssrf

jira-ssrf CVE-2017-9506 The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SS...

EUVD-2026-69634

An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote attacker could exploit this vulnerability under specific conditions to bypass authentication controls or exhaust system resources...

EUVD-2026-69628

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of...

CVE-2026-78592

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

CVE-2026-72682

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

CVE-2026-72652

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable...

CVE-2026-33465

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...