tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

clients web-v2026.9.0

Bitwarden Client Applications This repository houses all Bitwarden client applications except the mobile applications iOS | android. Please refer to the Clients section of the Contributing Documentation for build instructions, recommended tooling, code style tips, and lots of other great...

PT-2026-95007

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A flaw in the background job dispatch mechanism allows remote code execution with the privileges of the web user. The issue occurs because background job arguments are passed directly as the arg...

CVE-2026-54671: Authorization Bypass Through User-Controlled Key

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...

CVE-2026-92980: Unrestricted Upload of File with Dangerous Type

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-54504: Missing Authentication for Critical Function

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with STARTWEBUI enabled by default and WEBPORT set to 3080...

CVE-2025-15697: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2026-88792: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

CVE-2026-66617: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...

CVE-2026-66576: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

CVE-2026-66574: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

PT-2026-95158

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description An authorization bypass exists where the software maps InternoControle to an empty resource array in the 'web/controle/control.php' endpoint. The verificarPermissao function in...

PT-2026-94834

Name of the Vulnerable Software and Affected Versions HortusFox-Web versions prior to 6.1 Description Authenticated administrators can execute arbitrary operating system commands as the web server user by abusing the Import/Export functionality. This feature, designed for data portability, can be...

PT-2026-95179

Name of the Vulnerable Software and Affected Versions Brizy – Page Builder versions prior to 2.8.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web...

CVE-2026-54618: Missing Authentication for Critical Function

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULTMCPTOKEN without authenticating a client. An unauthenticated...

PT-2026-95077

Name of the Vulnerable Software and Affected Versions Obsidian Web MCP versions prior to 0.2.0 Description An authentication bypass exists where the '/oauth/authorize' endpoint issues an authorization code without requiring login, consent, or a session check. Subsequently, the '/oauth/token'...

easywall v2.20.1

easywall Your firewall. Your rules. No surprises. Live demo · Documentation · Changelog nftables through a web interface that cannot lock you out: every apply reverts itself unless you confirm it. The idea Editing a rule changes nothing. Applying it changes everything — for 120 seconds. If the ne...