CVE-2026-58448

CVE-2026-58448 affects yudao-cloud (BPM module) prior to 2026.06. A broken access control flaw allows any authenticated user to read arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected GET endpoint that lacks the @PreAuthorize annotati...

CVE-2026-58448 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation...

MAL-2026-6700 Malicious code in module-index-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on npm install...

Malicious code in module-index-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on npm install...

xss-cheatsheet

⚡ XSS Cheatsheet — Cross-Site Scripting Reference !Starsh...

GHSA-G4W6-VMGF-XQVX @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. An issue exists where, under...

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. An issue exists where, under...

nationstate-cyber-tools

NATION-STATE CYBER WEAPONS ARSENAL Live Web Page: htt...

freerdp:TestFuzzWinPRClipboard: Heap-buffer-overflow in _wcsnlen

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=5824412885254144 Project: freerdp Fuzzing Engine: centipede Fuzz Target: TestFuzzWinPRClipboard Job Type: centipedeasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Addres...

libredwg:llvmfuzz: Heap-double-free in dxf_blocks_read

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5692626108743680 Project: libredwg Fuzzing Engine: honggfuzz Fuzz Target: llvmfuzz Job Type: honggfuzzasanlibredwg Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x78956c0e01d0 Cra...

libyal:libluksde_volume_fuzzer: Stack-buffer-overflow in libluksde_password_pbkdf2

Detailed Report: https://oss-fuzz.com/testcase?key=5513603281911808 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libluksdevolumefuzzer Job Type: libfuzzerasani386libyal Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0xf66f0070 Crash State:...

mruby:mruby_fuzzer: Stack-use-after-return in parser_lex

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5317160201945088 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzerasanmruby Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address: 0x7bedc1e3e3c0...

libredwg:llvmfuzz: Heap-buffer-overflow in json_objects_write

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4506072807964672 Project: libredwg Fuzzing Engine: honggfuzz Fuzz Target: llvmfuzz Job Type: honggfuzzasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

CVE-2026-13593

A flaw was found in CSS::Minifier::XS. This vulnerability causes a memory leak when the software processes a document containing only characters that are meant to be removed, such as comments and whitespace. If an attacker provides specially crafted input, it could lead to excessive memory usage,...

libyal:libqcow_file_fuzzer: Heap-buffer-overflow in libqcow_internal_file_read_buffer_from_file_io_handle

Detailed Report: https://oss-fuzz.com/testcase?key=6523664565338112 Project: libyal Fuzzing Engine: afl Fuzz Target: libqcowfilefuzzer Job Type: aflasanlibyal Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x77469d0e06d3 Crash State:...

libreoffice:ww6fuzzer: Heap-use-after-free in SwContentIndex::Remove

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5959896152211456 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: ww6fuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

ghostscript:gs_device_ljet4_fuzzer: Crash in names_string_ref

Detailed Report: https://oss-fuzz.com/testcase?key=5669830234275840 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdeviceljet4fuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7b2c53aa1da0 Crash State: namesstringref copycspacedi...

PT-2026-53812

Name of the Vulnerable Software and Affected Versions Plugin for Google Analytics by IO technologies versions prior to 1.2 Description Cross-Site Request Forgery occurs on the Google Analytics settings page 'ga.php' due to missing or incorrect nonce validation. A nonce is a unique token used to...

PT-2026-53904

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2025.9 and earlier Description An unrestricted upload of files with dangerous types allows for arbitrary code execution in the context of the current user. This issue can be exploited without requiring any user...

PT-2026-54471

Name of the Vulnerable Software and Affected Versions Wp Google Places Review Slider versions prior to 18.2 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the file admin/partials/googlecrawl dfs.php. The place parameter is URL-decod...