LG to Ban Residential Proxies from Smart TV Apps

The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available...

GHSA-2RP8-MM9Q-FP49 TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

EUVD-2026-46431

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-63080

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-63080

Aptabase (through commit 5a89368) contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. The attack can be carried out by supplying malic...

CVE-2026-63080 Aptabase SQL Injection via ClickHouse query backend

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

GHSA-M932-CRVM-GCP5 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Summary The AddTime API handler continues execution after an error returned by GetUserByName. When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime...

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Summary The AddTime API handler continues execution after an error returned by GetUserByName. When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime...

GHSA-H2X6-G7Q6-344V Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...

Exploit for CVE-2026-53595

CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonymous ATO →...

fastjson-1.2.83-rce-jdk8-jdk25

Generate probes with 10-25 fd entries: java -cp "poc:poc/lib/a...

CVE-2026-15829

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

EUVD-2026-46317

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-15829

CVE-2026-15829 affects googleapis/mcp-toolbox (bigquery-forecast). The prebuilt forecasting tool interpolates client-controlled parameters (data_col, timestamp_col, id_cols) into a generated AI.FORECAST query via fmt.Sprintf without re-validation, enabling SQL injection (CWE-89) and a security bo...

CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

n8n-nodes-metasploit

n8n-nodes-metasploit !npm versionhttps://img.shields.io/n...

Minima-private

Minima Minima is a blockchain with an emphasis on every user...