DoS (Denial of Service) Apache Tomcat Dependency in Jira Service Management Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2026-13506 was introduced in 10.0.0 and later of Jira Service Management Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

DoS (Denial of Service) Apache Tomcat Dependency in Jira Software Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2026-13506 was introduced in 10.0.0 and later of Jira Software Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

DoS (Denial of Service) browserslist Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector...

DoS (Denial of Service) browserslist Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2026-53649

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScrip...

EUVD-2026-70253

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

DoS (Denial of Service) linkify-it Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

CVE-2026-53649

Joro is a web exploitation framework by BishopFox. Prior to version 1.1.1 , its default proxy mode exposes a local API on 127.0.0.1:9090 with no authentication and a wildcard CORS policy . Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on ...

CVE-2026-53649 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScrip...

EUVD-2026-70238

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScrip...

CVE-2026-53649 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScrip...

CVE-2026-84376

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79755

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...

CVE-2026-52832

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-20355

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20281

A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol SIP Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This...

CVE-2026-20354

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20212

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...

CVE-2026-48050

A flaw was found in Arc. This vulnerability allows a remote unauthenticated attacker to access Go debug pprof endpoints due to improper authentication bypass. Successful exploitation can lead to the disclosure of sensitive runtime state information and enable a CPU-burn Denial of Service DoS...