log4j-4255

log4j2 4255 — Bypass de la lista blanca de FilteredObjectInputStream mediante java.rmi.MarshalledObject Un laboratorio autocontenido y contenerizado que reproduce de extremo a extremo el problema4255 de Apache log4j2 contra los artefactos oficiales de Log4j 2.26.1 en JDK 17 , con controles...

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

EUVD-2026-81600

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package...

GHSA-C48M-32M9-VX93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

EUVD-2026-81594

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted...

BIT-DISCOURSE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1787889621)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787889621 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18....

Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1787889621)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787889621 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until...

CVE-2026-102983

The @astrojs/netlify adapter for the Astro web framework (versions 5.2.0 through 8.2.4) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that generated regular expressions for Netlify Image CDN remote-image allowlists lack anchoring to the beginning of the URL. This allows ...

CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

EUVD-2026-78395

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets...

GHSA-J6R3-76F7-8JCV ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

Summary isInSubnet and isHostInSubnet accept an address of either family and compare masked binary strings without checking that both operands are the same family. Address4 pads to 32 bits and Address6 to 128, so whenever the leading bits agree the strings are equal: new...

CVE-2026-55584

CVE-2026-55584 - Bypass de la lista de permitidos de IP de phpSysInfo CWE-290, CVSS 7.5 Alta, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resuelve la IP del cliente a partir de las cabeceras controladas por el atacante X-Forwarded-For luego Client-IP antes de recurrir a...

CVE-2026-101912 ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-101912 ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-27876

CVE-2026-27876: Escritura Arbitraria de Archivos en Expresiones SQL de Grafana que Deriva en RCE CVSS 9.1 Crítico | Escritura Arbitraria de Archivos | Ejecución Remota de Código Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Resumen La función de Expresiones...

CVE-2026-100674

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

CVE-2026-100674

The stoatchat application (versions prior to 0.15.5 ) is vulnerable to a username validation bypass due to insufficient revalidation after Unicode sanitization . An attacker can submit Unicode letters that transform into forbidden characters post-sanitization, allowing them to bypass character al...