Astra Linux – Vulnerability in docker.io-app

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is vulnerable to cache poisoning if the image is built FROM scratch. Additionally, changes to certain instructions—especially HEALTHCHECK and ONBUILD—do not trigger cache...

Security Bulletin: glibc vulnerability

Summary Prior versions of Classic Remote Capture may include this vulnerability. Vulnerability Details CVEID:CVE-2025-15281 DESCRIPTION: Calling wordexp with WRDEREUSE in conjunction with WRDEAPPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized...

Security Bulletin: curl vulnerability

Summary Prior versions of Classic Remote Capture may include this curl vulnerability. Vulnerability Details CVEID:CVE-2025-9086 DESCRIPTION: 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same hostname, but...

Exploit for Improper Input Validation in Apache Activemq

CVE-2026-34197 ActiveMQ Classic Security Detection Tool This...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' via the SpELFunction.call method. An attacker can execute arbitrary expression language code by supplying crafted input...

com.ibeetl:beetl-online-web (=3.15.3.RELEASE), com.ibeetl:beetl-spring-boot-starter-classic (>=3.14.1.RELEASE <=3.20.2.RELEASE) potentially affected by CVE-2026-8759 via com.ibeetl:beetl-spring-classic (>=3.14.1.RELEASE <=3.20.2.RELEASE)

com.ibeetl:beetl-spring-classic MAVEN version =3.14.1.RELEASE, =3.14.1.RELEASE, =3.20.2.RELEASE Source cves: CVE-2026-8759 Source advisory: OSV:GHSA-FMMW-44RP-JCFP...

GHSA-FMMW-44RP-JCFP Beetl's SpELFunction extension function has an expression injection risk

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of specia...

CVE-2026-8759

Technical details are not publicly available in the provided documents; no affected versions, vectors, or fixes are specified beyond the description. Monitor for updates.

bleak

BLEAK — Bluetooth Link Exploitation & Attack Knowledgebase...

Deserialization of Untrusted Data

Overview langchain-classic is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Deserialization of Untrusted Data when fetching and processing prompt manifests from external sources. An attacker can execute arbitrary code or manipulate...

agent-nexus-cli (>=0.1.0 <=0.1.31), agentiva (>=0.1.0 <=0.1.5) +42 more potentially affected by CVE-2026-45134 via langchain-classic (>=1.0.0 <=1.0.5)

langchain-classic PYPI version =1.0.0, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =3.0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =0.4.0, =0.7.0 - hspylib-askai =1.2.19 and more Source cves: CVE-2026-45134 Source advisory: SNYK:PYTHON-LANGCHAINCLASSIC-16658750...

agent-nexus-cli (>=0.1.0 <=0.1.31), agentiva (>=0.1.0 <=0.1.5) +42 more potentially affected by CVE-2026-45134 via langchain-classic (>=1.0.0 <=1.0.5)

langchain-classic PYPI version =1.0.0, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =3.0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =0.4.0, =0.7.0 - hspylib-askai =1.2.19 and more Source cves: CVE-2026-45134 Source advisory: OSV:GHSA-3644-Q5CJ-C5C7...

BIT-MONGODB-2026-4148 ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline...

CVE-2026-2052 Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval on user-supplied Display Logic...

WordPress plugin Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets 代码注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added to a...

SQLInjection

Projekt Edukacyjny: Podatności SQL Injection Niniejsze repozy...

EUVD-2026-25791

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

PT-2026-34867

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.6 Apache ActiveMQ versions 6.0.0 through 6.2.4 Apache ActiveMQ Broker versions prior to 5.19.6 Apache ActiveMQ Broker versions 6.0.0 through 6.2.4 Apache ActiveMQ All versions prior to 5.19.6 Apache...

SUSE CVE-2026-32105

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code MAC signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks th...

VulnCheck KEV: CVE-2025-48700

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting XSS vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information...