CVE-2026-77856

ash_typescript (Elixir/BEAM library by ash-project) contains a resource-exhaustion flaw in resolve_typed_struct_field/2 within field_selector.ex. When a client-supplied field name on a typed struct field has no match in the reverse map, the code falls back to String.to_atom/1 before any field-exi...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2017-9506

Proof of Concept SSRF & XSS root@kitploit: https://jira.you.com//plugins/servlet/oauth/users/icon-uri?consumerUri=http://www.google.co.uk CVE-2017-9506 L'IconUriServlet du plugin OAuth Atlassian, de la version 1.3.0 avant la version 1.9.12 et de la version 2.0.0 avant la version 2.0.4, permet à d...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

PT-2026-84534

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.0.0 Description An issue exists in the upload-resource API within the controllers/resource.go file. This flaw allows remote attackers to bypass authentication, leading to missing authentication for the affected...

PT-2026-84547

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

kern

kern: A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code. A real, kernel-enforced container in 3.5 ms, out of one 1.52 MB binary with no daemon. 0 RAM at rest · no daemon, no socket, nothing to start · one static binary, libc its only...

GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering

A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...

EUVD-2026-68744

netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...

CVE-2026-82818

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

cve-2019-17558-apache-solr-rce

Apache Solr RCE CVE-2019-17558 - CTF Write-up Практическая эксплуатация уязвимости Velocity Template Injection в Apache Solr: переход от сбоя автоматизированного инструмента Metasploit к успешной ручной эксплуатации. Этот write-up документирует полный ход рассуждений в ходе упражнения, с акцентом...

CVE-2026-79745

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

EUVD-2026-68719

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

CVE-2026-82818

dibo-software diboot 3.8.0 is affected by an improper access control vulnerability in the Tenant Resource Assignment Handler at /api/iam/tenant/resource. Manipulation of the tenantId argument allows a remote attacker with low privileges to bypass access controls, resulting in low impact on confid...

CVE-2026-82818 dibo-software diboot Tenant Resource Assignment resource access control

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

CVE-2026-79745

MCPHub is a unified hub for centrally managing and orchestrating multiple MCP servers/APIs. Prior to version 1.0.32 , the built-in prompt and resource controllers perform no role checking — the mutating POST/PUT routes for /api/prompts* and /api/resources* are attached to the authenticated router...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

viber-desktop-html-injection

Viber Desktop — Injection HTML CVE-2025-55996 CVE: CVE-2025-55996 Découvreur : Thaw Khant Cycbake Produit : Viber Desktop Affecté : Viber Desktop 25.6.0 et possiblement versions antérieures Résumé Le gestionnaire de liens profonds de Viber Desktop viber://forward?text= peut restituer du HTML non...

Important: Red Hat Security Advisory: iperf3 security update

An update for iperf3 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...