Vikunja: Unbounded CSV row cardinality permits API process termination

Unbounded CSV row cardinality permits API process termination Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a string and then materializes a full task object for every row before insertion. Two million one-cell rows f...

EUVD-2026-78645

Vikunja: Unbounded CSV row cardinality permits API process termination...

Vikunja: Unbounded nested task-filter recursion permits API process termination

Unbounded nested task-filter recursion permits API process termination Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactical...

EUVD-2026-78644

Vikunja: Unbounded nested task-filter recursion permits API process termination...

GHSA-XXC3-XPMC-VMVR Vikunja: Unbounded nested task-filter recursion permits API process termination

Unbounded nested task-filter recursion permits API process termination Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactical...

EUVD-2026-78650

Vikunja: Denial of service via decompression bomb in the data import...

cve-2026-43515-poc

CVE-2026-43515 — Apache Tomcat Security Constraint Bypass Exploitability verdict: confirmed exploitable. A POST request to a resource protected by a split configuration bypasses authentication entirely. The required web.xml shape is uncommon in standard deployments — see Analysis for details. Tab...

CVE-2026-106395

An uninitialized resource flaw was found in the Dawn component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553121488...

CVE-2026-106370

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517033396...

CVE-2026-106261

An uninitialized resource flaw was found in the Video component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/504638005...

CVE-2026-106223

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501633302...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

CVE-2026-107834

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) is vulnerable to resource exhaustion due to improper file handle management in the internal/bodyprocessors/multipart.go component. The multipart loop executes defer temp.Close() for every uploaded file part, preventing descriptors from ...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

cve-2019-17558-apache-solr-rce

Apache Solr RCE CVE-2019-17558 - CTF Write-up Practical exploitation of a Velocity Template Injection vulnerability in Apache Solr, progressing from a failure in an automated tool Metasploit to a successful manual exploitation. This write-up documents the complete reasoning of the exercise,...

Flipper

Playground and dump of stuff I made, modified, researched, or found for the Flipper Zero. Looking for Infrared IR codes? Head over tothe IRDB! Just want to download part of any repo? Try over here! If you're new to github in general, check out this great guide from Wr3nch! Other great spots for...

CVE-2026-106379

An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561987051...

CVE-2026-106184

An uninitialized resource flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/567379988...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-core.jar in IBM Integration Designer: CVE-2026-89407 and CVE-2026-89425 Vulnerability Details CVEID:CVE-2026-89407 DESCRIPTION: NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOA...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-91776 and CVE-2026-91777 Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplie...