272919 matches found
DEBIAN-CVE-2026-47884
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47875
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...
CVE-2026-47864
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47884
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-77018
The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...
CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...
EUVD-2026-66880
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...
CVE-2026-19225
Defender Security WordPress plugin versions before 6.2.0 fail to restrict a network-wide setting (via the Hub Connector ) to network administrators on multisite installations. As a result, an administrator of any single site in the network can execute arbitrary code across the entire network . Th...
WordPress Defender Security plugin < 6.2.0 - Admin+ Network-Wide RCE vulnerability
Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Defender Security versions 6.2.0...
CVE-2026-19225 Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
CVE-2026-77991
Joomla Event Manager (a Joomla extension from joomlaeventmanager.net) versions prior to 5.0.1 are vulnerable to privileged remote code execution due to a flaw in the administrator source model , which allows writing dangerous file types including PHP. An authenticated attacker with high privilege...
CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
EUVD-2026-66866
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
EUVD-2026-66852
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47864
Spring Integration 's SerializingHttpMessageConverter deserializes incoming HTTP request bodies using a raw java.io.ObjectInputStream with no class filtering. Any request with Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is processed directly via r...
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
Triage-CVE-2021-26855-ProxyLogon---Microsoft-Exchange-
ट्रायेज: CVE-2021-26855 ProxyLogon - Microsoft Exchange इस लैब में, लक्ष्य एक प्रसिद्ध वास्तविक दुनिया की भेद्यता का ट्रायेज उसी तरह अभ्यास करना था जैसे एक सुरक्षा टीम करती है: CVE विवरण पढ़ना, CVSS स्कोर समझना, और यह तर्क करना कि स्थिति के आधार पर यह वास्तव में कितना जोखिम भरा है। चरण 1: NVD में...