Release of Invalid Pointer or Reference

Overview Affected versions of this package are vulnerable to Release of Invalid Pointer or Reference through the MVG decoder. An attacker can cause the application to crash by submitting a specially crafted MVG image that triggers an invalid memory free operation. Remediation A fix was pushed int...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the RSVG decoder when built without cairo support. An attacker can cause access to freed memory and application crash by supplying crafted SVG files that trigger a decoding limit. Remediation A fix was pushed into the...

CVE-2026-105828 Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

text4shell-poc

Aplicación de Prueba PoC para CVE-2022-42889 Esta es una aplicación vulnerable desarrollada como Prueba de Concepto para la vulnerabilidad CVE-2022-42889. Instalación con Maven Para ejecutarlo necesitarás: JDK 17 o superior Maven 1. Clona el repositorio git git clone...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

SecureShopProj

SecureShop - Vulnerable E-Commerce Application Security Lab S...

CLEANSTART-2026-IL67419 Netty is an asynchronous, event-driven network application framework

CVE-2026-42580 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

PT-2026-108134

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description An out-of-bounds read occurs during SCRAM authentication response parsing when the driver processes a malformed server-final message. This allows the system to read one byte beyond a...

CVE-2026-107738: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107731: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-106428: Out-of-bounds Read

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...

CVE-2026-107797: Improper Neutralization of Input During Web Page Generation

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

PT-2026-107787

The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...

PT-2026-108256

Name of the Vulnerable Software and Affected Versions Jivejdon versions 5489372d through ee67a65e Description A reflected cross-site scripting issue exists in the 'application/query/taggedThreadList.jsp' endpoint. Unauthenticated attackers can inject scripts through the unencoded tagID and count...

PT-2026-108306

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The ChmFile::GetCharZ function narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without performing a lower-bound check. If an offset becomes negative, the...

Wireshark 1.10.x < 1.10.7 A Vulnerability (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.10.7. It is, therefore, affected by a vulnerability as referenced in the wireshark-1.10.7 advisory. - The srtpaddaddress function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before...

Apache Artemis Authentication Bypass

The vulnerability of asynchronous messaging systems like Apache ActiveMQ and Apache Artemis lies in the lack of authentication for critical functions. Exploiting this vulnerability can allow a malicious actor to gain full control over the application...

PT-2026-107987

Name of the Vulnerable Software and Affected Versions Parse Server versions 8.2.2 through 8.6.91 Parse Server versions 9.0.0 through 9.10.1-alpha.11 Description An information disclosure issue exists where GraphQL validation error messages reveal hidden class names even when public introspection ...

CVE-2026-107730: Integer Overflow or Wraparound

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

Uncontrolled Recursion

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...