joomla_rce_CVE-2015-8562

joomlarceCVE-2015-8562 All versions of the Joomla! below 3.4.6 are known to be vulnerable. But exploitation is possible with PHP versions below 5.5.29, 5.6.13 and below 5.5. Démo : https://www.youtube.com/watch?v=twqYpn1ir4o...

maat

About Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides various functionalities such as symbolic execution, taint analysis, constraint solving, binary loading, environment simulation, and leverages Ghidra's sleigh library for assembly lifting:...

CVE-2026-72633

Kibana Entity Analytics is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user with only read-level Security feature access —and no Elasticsearch privileges—to stop the recurring Privilege Monitoring engine task for a Kibana space. When this occurs, privileged ...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

Important: Red Hat Security Advisory: runc security update

An update for runc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-82740

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

CVE-2026-82736

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82740 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

EUVD-2026-68945

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

CVE-2026-82736

ash-project ash (Elixir web framework) contains an Incorrect Behavior Order: Validate Before Canonicalize vulnerability in Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex). The max_length , min_length , and match constraints were validated against the value as submitted , while t...

EUVD-2026-68963

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

EEF-CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Summary Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.apply\constraints/2 lib/ash/type/ci\string.ex validated the max\length, min\lengt...

EUVD-2026-68962

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

EEF-CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply\constraints/2 lib/ash/type/string.ex evaluated the :match regex...

CVE-2026-82734

CVE-2026-82734 affects ash-project ash (Elixir), versions 1.28.0 through 3.32.1 . The vulnerability is in Ash.Type.Decimal (lib/ash/type/decimal.ex), which casts input via Ecto's decimal cast without verifying the result is finite. Because Elixir's Decimal module treats Infinity and NaN as valid ...

CVE-2026-82732

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

EUVD-2026-68927

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...