Adobe AEM Dispatcher <4.15 - Rules Bypass

Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors. id: CVE-2016-0957 info: name: Adobe AEM Dispatcher 4.15 - Rules Bypass author: geeknik severity:...

Langflow - Broken Access Control

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

CVE-2025-55182

Herramienta de detección por lotes CVE-2025-55182 Herramienta eficiente de detección por lotes para la vulnerabilidad de contaminación de prototipos CVE-2025-55182 de Next.js. Introducción a la vulnerabilidad CVE-2025-55182 es una vulnerabilidad de contaminación de prototipos en el framework...

PT-2026-107858

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

EulerOS 2.0 SP15 : graphite2 (EulerOS-SA-2026-3978)

According to the versions of the graphite2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an...

PT-2026-107773

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...

Backstage: Improper input validation in Sentry scaffolder actions

Impact An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. Patches Upgrade...

EUVD-2026-93999

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback...

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches ...

R2S_CVE-2025-55182

Escáner CVE-2025-55182 Escáner de vulnerabilidades para CVE-2025-55182 - Ejecución remota de código en Server Actions de Next.js. Acerca de CVE-2025-55182 Gravedad: Crítica CVSS por determinar Versiones afectadas: Next.js: 15.x 15.5.7, 16.0.x 16.0.7 React: 19.0.0, 19.1.0, 19.1.1, 19.2.0 Impacto:...

cve-2025-66478

CVE-2025-55182 Este repositorio proporciona un entorno mínimo intencionalmente vulnerable para probar scanners de seguridad contra las recientes vulnerabilidades críticas de RCE que afectan a React Server Components y Next.js. !Warning Esta configuración es intencionalmente vulnerable y nunca deb...

CVE-2026-105316

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

EUVD-2026-94185

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

CVE-2026-105316 Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

CVE-2026-94205

A flaw was found in Gitea Actions. When determining whether workflow runs from fork pull requests require approval, Gitea evaluated the identity of the user triggering the event rather than the author of the pull request. Consequently, routine repository maintainer actions, such as adding a label...

trivysupplychainanalysis

Análisis Cuantitativo de Ataques a la Cadena de Suministro CI/CD de Múltiples Etapas Una reconstrucción cuantitativa y formalmente verificada del compromiso de la cadena de suministro de GitHub Actions de Trivy / "TeamPCP" de marzo de 2026 CVE-2026-33634 — modelado en TLA+, verificado...

CVE-2026-104844 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, node-red, commercial-gitlab-rails-ee, actions-runner, npm, vitess, pulumi, gitlab-rails-ce-fips, jupyter-base-notebook...

GHSA-RJ75-HQRM-R3GF vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, node-red, commercial-gitlab-rails-ee, actions-runner, npm, vitess, pulumi, gitlab-rails-ce-fips, jupyter-base-notebook...

PT-2026-107398

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

PT-2026-107408

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...