NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

EUVD-2026-67862

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584

phpSysInfo versions ≤ 3.4.5 contain an IP allowlist bypass in the PSI_ALLOWED check within read_config.php. The vulnerable code resolves the client IP from attacker-controlled X-Forwarded-For and Client-IP headers before falling back to REMOTE_ADDR, with no trusted-proxy concept. A remote unauthe...

CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-82078

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-80213

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP-Whitelist-Umgehung CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Referenzen: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED löst die Client-IP aus den vom Angreifer kontrollierten Headern X-Forwarded-For dann Client-IP auf, bevor auf REMOTEADDR zurückgegriffen wird. Es gibt...

CVE-2026-80213

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...

CVE-2026-80213

CVE-2026-80213 affects the resolv gem (before 0.7.2 ) for Ruby. The vulnerability resides in Resolv::DNS::MessageEncoder , which wrote a DNS label's length into a single octet without range validation. Labels longer than 255 octets had their length stored modulo 256 while the label data was writt...

CVE-2026-80213

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...

EUVD-2026-67139

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...

log4j-4255

log4j2 4255 — Bypass della allowlist di FilteredObjectInputStream tramite java.rmi.MarshalledObject Un laboratorio autonomo e containerizzato che riproduce end-to-end l'issue Apache log4j24255 utilizzando gli artefatti ufficiali Log4j 2.26.1 su JDK 17 , con controlli positivi, un oracle indurito ...

CVE-2026-59275

Spring AMQP versions 4.1.0, 4.0.0–4.0.4, 3.2.0–3.2.12, and 2.4.18 and earlier are affected by a remote JVM termination vulnerability. A single hostile AMQP message triggers nested-array Java deserialization that bypasses the allowlist, causing a StackOverflowError . The default JavaLangErrorHandl...

CVE-2026-59275 Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

A single hostile AMQP message can terminate the entire consumer JVM System.exit99, not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47875

Spring Batch (org.springframework.batch:spring-batch-core) versions 6.0.0–6.0.4 and 5.2.0–5.2.6 are vulnerable to a deserialization attack in the JobParameterDeserializer . When applications use Jackson2ExecutionContextStringSerializer to deserialize execution contexts from an untrusted job-repos...

GO-2026-6291 mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias in github.com/sonirico/mcp-shell

mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias in github.com/sonirico/mcp-shell...

CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

Linux Distros Unpatched Vulnerability : CVE-2026-10582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...