jsonorg-fp2

json.org CVE-2022-45688 Fehlalarm Das Projekt enthält eine json.org-Abhängigkeit mit CVE-2022-45688. Sie ruft zwar die verwundbare Klasse auf, aber die Eingabedaten sind fest verdrahtet und nicht geeignet, einen DoS-Angriff auszulösen. Die Schwachstelle kann daher nicht für einen DoS-Angriff...

jsonorg-fp1

falso positivo CVE-2022-45688 di json.org Il progetto contiene una dipendenza json.org con CVE-2022-45688 ma non invoca la classe vulnerabile. La vulnerabilità non può quindi essere sfruttata per un attacco DoS. Le analisi di composizione software basate su metadati produrranno un falso positivo,...

jsonorg-fn1

json.org CVE-2022-45688 falso negativo Il progetto illustra CVE-2022-45688 in json.org -- c'è una semplice applicazione XML2JSONConverter per leggere XML dall'input, convertirlo in JSON e stamparlo in modo ordinato sulla console. Utilizzando un input malevolo, l'applicazione va in crash con uno...

CVE-2026-59299

CVE-2026-59299 affects Spring Cloud Function (versions 5.0.0–5.0.3 , 4.3.0–4.3.4 , 4.2.0–4.2.7 , and 3.2.16 and earlier ). The vulnerability involves a composition lookup that can potentially poison the base function , leading to low impact on both confidentiality and integrity. The CVSS 3.1 base...

EUVD-2026-67185

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

ROOT-APP-NPM-CVE-2025-64530 CVE-2025-64530 in @apollo/composition - Patched by Root

Root has patched CVE-2025-64530 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-M8JR-FXQX-8XX6 GHSA-m8jr-fxqx-8xx6 in @apollo/composition - Patched by Root

Root has patched GHSA-m8jr-fxqx-8xx6 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

CVE-2026-36340

CVE-2026-36340 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critica Prodotto interessato: Krayin CRM v2.1.5 Tipo di vulnerabilità: Remote Code Execution RCE Autenticazione richiesta: S...

SCTT-2026-33-0002-DWM-Visual-Field-Singularity

SCTT-2026-33-0002: Singolarità del Campo Visivo DWM 📡 Classificazione Teorica ID: SCTT-2026-33-0002 Ricercatore: Americo Simoes SimoesCTT Fisica: Teorema 4.2 - Transizione di Fase Turbolenta TPT Costante: α = 0.0302011 Target: Desktop Window Manager dwm.exe / Componente Grafico di Windows...

-SCTT-2026-33-0002-DWM-Visual-Field-Singularity

SCTT-2026-33-0002: Singolarità del Campo Visivo DWM 📡 Classificazione Teorica ID: SCTT-2026-33-0002 Ricercatore: Americo Simoes SimoesCTT Fisica: Teorema 4.2 - Transizione di Fase Turbolenta TPT Costante: α = 0.0302011 Target: Desktop Window Manager dwm.exe / Componente Grafico di Windows...

guac

GUAC: Grafo per la Comprensione della Composizione degli Artefatti Nota: GUAC è in fase di sviluppo attivo - se sei interessato a contribuire, consulta la guida per i contributori. GUAC è un progetto in incubazione di OpenSSF sotto il Supply Chain Integrity WG. Graph for Understanding Artifact...

grepmarx

Grepmarx - Piattaforma di Sicurezza delle Applicazioni Grepmarx è un'applicazione web che fornisce una piattaforma unica per comprendere, analizzare e identificare rapidamente le vulnerabilità in basi di codice potenzialmente grandi e sconosciute. Caratteristiche Capacità SAST Static Analysis...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

EUVD-2026-60090

opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...

Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Base Model Routing Bypasses Access Control via Model Chaining Affected ComponentModel chaining via basemodelid:- backend/openwebui/routers/models.py lines 170-214, createnewmodel- backend/openwebui/routers/models.py lines 254-308, importmodels- backend/openwebui/main.py lines 1696-1711, base mode...

PT-2026-56505

Name of the Vulnerable Software and Affected Versions Hono versions 4.0.0 through 4.12.26 Description The cx function in hono/css composes class names from plain strings but marks the result as already escaped without performing HTML-escaping on the input. This allows untrusted className values...

CVE-2026-44555

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via basemodelid: a user-defined model e.g., "Cheap Assistant" can reference an existing base model e.g., "gpt-4-turbo-restricted" that provides...

CVE-2026-40989 Self Routing guard bypassed via function composition

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud...

Astra Linux – Vulnerability in Thunderbird

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive Chrome-level privileges; however, it could be used as a stepping stone for further attacks involving other vulnerabilities. This vulnerability affects...

CVE-2026-33642

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handlecomposecommand function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer...