CVE-2026-7777-Rust-Use-After-Free-in-Unsafe-Web-Server

CVE-2026-7777 – Rust Use‑After‑Free in Unsafe Web Server Program Code Rust // uafserver.rs - Vulnerable Rust HTTP server with use-after-free use std::sync::Arc, Mutex; use std::thread; use std::io::prelude::; use std::net::TcpListener, TcpStream; struct SharedBuffer data: Vec, impl SharedBuffer f...

CVE-2025-45809-PoC

CVE-2025-45809 — LiteLLM SQL Injection via /key/block Time-Based Blind SQLi LiteLLM v1.65.4 versions before v1.81.0 /key/block and /key/unblock endpoints have a SQL injection vulnerability in the key parameter. Attackers can use time-based blind injection techniques to steal database content and...

cve-2026-42945-scan

cve-2026-42945-scan Static scanner for NGINX configuration files that detects the rewrite/set pattern associated with CVE-2026-42945. The scanner parses NGINX configs with crossplane, walks location blocks, and prints every location that looks affected in this format: //xxx.conf: - location XXXXX...

CVE-2026-87939

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2...

CVE-2026-84910

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5...

CVE-2026-84916

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

EUVD-2026-107862

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2...

CVE-2026-87939 Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2...

CVE-2026-87939 Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2...

CVE-2026-87939

The Drupal Feed Block module is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to sufficiently validate or sanitize the RSS feeds it generates from remote sources. This allows an attacker to inject malicious scripts into web pages viewed by other users. The issue affects version...

CVE-2026-87939

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2...

OGNL Stricter-invocation Block List Bypass Via Java.lang.reflect Reflection Proxies

Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as "Runtime", "ProcessBuilder", and "ClassLoader". The block list filters on the declaring class of the method OGNL invokes. Because...

DRUPAL-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

CVE-2026-98635

A flaw was found in the Linux kernel. An attacker who attaches a specially crafted storage device can cause a Denial of Service DoS or kernel memory corruption. When the kernel revalidates zoned block devices—storage media divided into independent physical regions—it fails to verify that the...

GHSA-CRWC-VW2R-QR6M OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as Runtime, ProcessBuilder, and ClassLoader. The block list filters on the declaring class of the method OGNL invokes. Because...

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as Runtime, ProcessBuilder, and ClassLoader. The block list filters on the declaring class of the method OGNL invokes. Because...

CVE-2026-113793

The pypdf library, a pure-python PDF library, is vulnerable to a denial-of-service condition in versions prior to 6.20.1 . The root cause is an infinite loop triggered when removing an object from a crafted cyclic PDF tree , such as an outline item, which results in the current process being bloc...

CVE-2026-113793 pypdf: Possible infinite loop when removing tree items

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1...

CVE-2026-113793 pypdf: Possible infinite loop when removing tree items

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1...

DEBIAN-CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...