CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb con la versión 6.1.2.0 o inferior, contiene una vulnerabilidad de Ejecución Remota de Código RCE dentro de su función de Configuración de Notificaciones. Un atacante autenticado con privilegios de "Configuración del Sistema" en ASWeb puede explot...

CVE-2024-6783

CVE-2024-6783 - Vue CVE A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript...

CVE-2025-53772-IIS-WebDeploy-RCE

CVE-2025-53772 - Exploit de RCE para IIS WebDeploy Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2025-53772, una vulnerabilidad de Ejecución Remota de Código en IIS WebDeploy mediante deserialización insegura. ⚠️ Descargo de responsabilidad Esta herramienta es solo para...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253：深入剖析 Adobe AEM-Forms 零日漏洞 — 渗透测试人员与防御者必须采取的行动 TL;DR： Adobe Experience Manager AEM Forms on JEE（≤ 6.5.23.0）存在一个可通过网络访问的关键漏洞（CVE-2025-54253），该漏洞利用被滥用的 Struts/OGNL 端点，允许未经身份验证的远程代码执行。另一个伴生 XXE 漏洞（CVE-2025-54254）可实现任意文件读取。这些是影响广泛的企业级问题 — 请立即修补、搜寻入侵指标，并应用强化配置和检测控制。 为何此事至关重要 AEM...

CVE-2026-82028

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-54334

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...

CVE-2026-54333

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-17133

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-17416

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-17156

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-16428

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine...

CVE-2026-54334 UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...

CVE-2026-54334 UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...

CVE-2026-54334

CVE-2026-54334 is a heap out-of-bounds write in the uefi-firmware Python package's native Tiano/EFI decompressor. The flaw is in ReadCLen() within uefi_firmware/compression/Tiano/Decompress.c: it reads a 9-bit value (up to 511) and writes into the 510-element Sd->mCLen heap array without bound...

CVE-2026-54333 UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-54333 UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-54333

CVE-2026-54333 is a stack out-of-bounds write in the uefi-firmware Python package (UEFI Firmware Parser). The vulnerable function MakeTable() in uefi_firmware/compression/Tiano/Decompress.c fails to validate that bit-length values from a crafted Tiano/EFI compressed firmware bitstream stay within...

EUVD-2026-77810

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028

Magistrala versions before 1.0.0 are affected by a SQL injection in the timescale-reader and postgres-reader HTTP API services. The root cause is a malicious format query parameter interpolated directly into the FROM clause without parameterization or identifier quoting. An authenticated attacker...