Security Bulletin: IBM® Db2® could allow a authenticated attacker to cause a denial of service due to uncontrolled resource consumption (CVE-2026-17463)

Summary IBM® Db2® could allow a authenticated attacker to cause a denial of service due to uncontrolled resource consumption CVE-2026-17463 Vulnerability Details CVEID:CVE-2026-17463 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2...

CVE-2022-30023

CVE-2022-30023 Inyección de comandos autenticada en el router Tenda HG9 Uso git clone https://github.com/Haniwa0x01/CVE-2022-30023 cd CVE-2022-30023 python exploit.py -u http://target -U "user" -P "password" Ejemplo pc@pc-note:/CVE-2022-30023/$ python3 exploit.py -u "http://10.0.0.1" -U "admin" -...

EUVD-2026-88260

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...

EUVD-2026-88259

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later fixed in 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any...

EUVD-2026-88258

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

EUVD-2026-88257

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT 反序列化 - Je Yiuwai's Blog CVE-2023-0669 CVE-2023-0669是一个GoAnywhere MFT反序列化漏洞，由于反序列化一个任意攻击者控制的对象，在License Response Servlet中存在一个预先认证的命令注入漏洞。攻击者可以利用该漏洞在受影响的系统上执行任意代码，从而导致系统被完全控制。该漏洞影响版本为7.1.2之前，不包括7.1.2。 CVE-2023-0669 is a GoAnywhere MFT deserialization vulnerability that...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-18825

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

cve-2019-3398

cve-2019-3398 详情 一个用Python编写的针对CVE-2019-3398 Confluence漏洞的快速概念验证脚本。 受影响的Confluence版本为6.12.3、6.13.3、6.14.2和6.15.1。 该漏洞利用需要有效的凭据。 使用 编辑osusername和ospassword字段，并且根据目标服务器的情况可能需要修改filename路径。如果路径设置正确，shell.jsp将可以在Web服务器的根目录访问到。...

CVE-2023-20273

CVE-2023-20273 PoC del exploit CVE-2023-20273 Uso usage: exploit.py -h -t URL -u Username -p Password -c Command | -r -dest Outfile -www | -tcp | -null -ip LocalIP -port LocalPort -fs filesystem -path filepath -operation operationtype -v -q CVE-2023-20273 Exploit PoC options: -h, --help show this...

CVE-2026-98115

A flaw was found in the Linux kernel's ksmbd Server Message Block subsystem, which may lead to a Denial of Service DoS. When terminating multichannel SMB connections, the server fails to properly synchronize and wait for all communication channels to finish before freeing shared session resources...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 es una vulnerabilidad de Cross-Site Scripting Almacenado Stored XSS que afecta a Mautic 7 versiones 7.0.0 a 7.1.1. La falla existe en el componente Projects, donde los nombres de los proyectos se muestran como etiquetas y popovers al pasar el cursor en páginas...

EUVD-2026-88239

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825

The connect-xcors npm package contains an Origin Validation Error within its middleware. This flaw allows an attacker to bypass origin verification , potentially enabling the execution of cross-domain authenticated requests . The vulnerability has a CVSS 4.0 base score of 5.3 (MEDIUM) . No specif...

CVE-2021-2109

Descripción Vulnerabilidad en el producto Oracle WebLogic Server de Oracle Fusion Middleware componente: Console. Las versiones compatibles afectadas son 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 y 14.1.1.0.0. La vulnerabilidad fácilmente explotable permite a un atacante con altos privilegio...

CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – Configuración incorrecta de CORS que conduce a la exposición de datos autenticados 📌 Referencia de aviso ID de CVE: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 Proveedor: karnop Producto: realtime-collaboration-platform Gravedad: ALTA CVSS 7.4 Vector:...

CVE-2023-26262

Sitecore 10.3 Vulnerabilidad de carga de archivos autenticada Autor: Thomas Stern Fecha: 26/01-2023 Resumen Es posible, mediante la funcionalidad de importación de idiomas, cargar un archivo arbitrario. Este archivo podría ser una webshell que permitiría la ejecución de código en el servidor. Pas...