CVE-2025-13394 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2025-13394 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2025-13394

The CVE-2025-13394 entry describes a CSRF issue in the Carbon console's Ajax processor. State-changing operations are performed via HTTP GET, and while SameSite=Lax cookies are used, this mitigation is bypassed for cross-origin top-level navigation, allowing an authenticated user’s browser to tri...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

EUVD-2025-210631

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

reverse_ssh v2.8.1

Reverse SSH Art credit to https://www.instagram.com/smart.hedgehog.art/ Want to use SSH for reverse shells? Now you can. Manage and connect to reverse shells with native SSH syntax Dynamic, local and remote forwarding Native SCP and SFTP implementations for retrieving files from your targets Full...

Security Bulletin: Multiple security vulnerabilities have been found in IBM Security Verify Information Queue

Summary Multiple security vulnerabilities in the third-party libraries have been addressed in IBM Security Verify Information Queue ISIQ. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5,...

Security Bulletin: Oracle Outside In Technology (OIT) v8.5.8 BP3 vulnerabilities CVE-2026-25646 (vulnerable), CVE-2026-25210 (vulnerable), CVE-2026-22184, CVE-2025-68431(affected, not vulnerable) in FileNet Content Manager (FNCM) Content

Summary Oracle Outside In Technology OIT v8.5.8 BP3 January, 2026 vulnerabilities CVE-2026-25646 vulnerable, CVE-2026-25210 vulnerable, CVE-2026-22184, CVE-2025-68431affected, not vulnerable in FileNet Content Manager FNCM Content Based Retrieval CBR content indexing Vulnerability Details...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.1 Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untruste...

Security Bulletin: There is a vulnerability in netty-resolver-dns-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-45673, CVE-2026-45674, CVE-2026-47691)

Summary There is a vulnerability in netty-resolver-dns-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-45673 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior t...

CVE-2026-67869

A flaw was found in open62541. A remote attacker can exploit a buffer overflow vulnerability within the ServiceCall function. This vulnerability arises from improper validation of input arguments against runtime-resolved InputArguments metadata, which can lead to a denial of service DoS. Mitigati...

Shadowbroker v0.9.84

🛰️ S H A D O W B R O K E R Global Threat Intercept — Real-Time Geospatial Intelligence Platform ShadowBroker ShadowBroker is a decentralized intelligence platform that aggregates real-time, multi-domain OSINT telemetry from 60+ live intelligence feeds into a single dark-ops map interface. Aircraft...

cvelistV5 cve_2026-08-06_0000Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

SUSE CVE-2026-67182

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

SUSE CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

SUSE CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

hosts v3.16.104

!IMPORTANT Cloning this repository can take a long time! You probably just want to start with the latest version, not its whole history since 2018. Therefore you probably want to use git clone --depth 1 ... to save significant time. !NOTE With the exception of issues and PRs regarding changes to...

TencentOS Server 3: kernel (TSSA-2026:0793)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0793 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP13 : unbound (EulerOS-SA-2026-3054)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-2899)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.x000D x000D The...