Cross-Virtual-Fabric Context Switching and Horizontal Privilege Escalation in Brocade Fabric OS

: An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary...

Access Control Bypass vulnerability in the RBAC validation engine of Brocade Fabric OS

| Summary: An Access Control Bypass vulnerability exists in the Role-Based Access Control RBAC validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permissi...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1972:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1972:01 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificat...

PT-2026-107248

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-sentry versions 0.3.0 through 0.3.7 Description Improper input validation in sentry scaffolder actions allows an authenticated internal user to force the backend to contact unintended destinations...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not validated Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-main embedded HTTP server builds its JWT authenticator from a keystore alone when neither jwtIssuer nor jwtAudience is configured, so inbound...

CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass

CVE-2026-49230 — Apache APISIX jwe-decrypt Authentication Bypass Proof of concept for an authentication bypass in the Apache APISIX jwe-decrypt plugin. The plugin decrypts a JWE token and forwards its plaintext to the upstream, acting as an authentication gate — but it never validates the AES-GCM...

EUVD-2026-78300

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...

adaPwn

adaPwn - CVE-2019-14912 PoC adAS OPENSSO module doesn't correctly verify the domain to redirect, making possible to redirect the user to an attacker controlled website, stealing his adAS session cookie. Usage usage: adaPwn.py -h --interface INTERFACE --httpPort HTTPPORT --dnsPort DNSPORT ipToSpoo...

CVE-2023-43144

CVE-2023-43144 Description Assets Management System 1.0 is vulnerable to SQL injection via the id parameter in delete.php PoC sqlmap -u 'http://localhost/delete.php?id=4' --cookie="PHPSESSID=SESSID" --dbms=MySQL --dbs --batch Code review delete.php ?php include 'core/init.php'; $id = $GET'id';...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

CVE-2024-36401-GeoServer-RCE

RCE vulnerability in GeoServer CVE-2024-36401 - detection script CVE-2024-36401 is a critical security vulnerability affecting GeoServer, an open-source server for sharing geospatial data, and GeoTools, an open-source Java library that provides tools for geospatial data. The vulnerability,...

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup or Resolver::lookupip on a resolver with DNSSEC validation enabled, both methods return Ok... if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSS...

GHSA-5J98-2G5X-46V6 hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup or Resolver::lookupip on a resolver with DNSSEC validation enabled, both methods return Ok... if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSS...

CVE-2023-38890

CVE-2023-38890 Description Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in t...

EUVD-2026-91749

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546

The MongoDB Controllers for Kubernetes are vulnerable to improper validation of Ops Manager backup configuration . An attacker with permissions to modify an OpsManager custom resource can trigger unintended administrative changes in Ops Manager. This vulnerability specifically impacts deployments...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...