CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

PT-2024-26365 · Unknown · Paperless-Ngx

Name of the Vulnerable Software and Affected Versions: Paperless-ngx versions 2.5.0 through 2.8.5 Description: The issue concerns remote user authentication in a document management system, allowing API access even when API access is explicitly disabled. Recommendations: For versions 2.5.0 throug...

PT-2024-23246 · Unknown · Buddyforms

Name of the Vulnerable Software and Affected Versions: BuddyForms versions prior to 2.8.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables an attacker to inject malicious...