NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service vulnerability discovered by ? in WordPress Npm next versions = 15.0.0, 15.5.27...

EUVD-2026-93508

Payload: Bypassed sanitization of user uploaded SVGs...

rustbuster

rustbuster 포괄적인 웹 퍼저 및 콘텐츠 발견 도구 소개 블로그 글 확인: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool 다운로드 미리 빌드된 바이너리를 여기에서 다운로드할 수 있습니다. 설치 installrustbuster echo "Installing latest version of Rustbuster" latestversion=curl -s https://github.com/phra/rustbuster/releases |...

EUVD-2026-92447

mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control...

GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

GHSA-7649-WM97-W3J3 Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

EUVD-2026-94015

Backstage: Improper input validation in cloud storage URL readers...

demiguise

Demiguise - HTA 암호화 도구 NCC Group Plc가 오픈 소스로 공개 - http://www.nccgroup.trust/ Richard Warren 개발, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise AGPL 라이선스로 배포, 자세한 내용은 LICENSE 참조 기능? 이 프로젝트의 목표는 암호화된 HTA 파일을 포함하는 .html 파일을 생성하는 것입니다. 아이디어는 대상자가 페이지를 방문하면 키를 가져와서...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF003 for September 2026

Summary IBM Content Cortex CCx 26.0.0-IF003 addresses CVEs across components including CPE, GraphQL, External share and Content Based Search Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without...

DRUPAL-CONTRIB-2026-204

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...

BIT-JOOMLA-2026-90916 Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260906 - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents...

AOSP-ExploitUserDictionary

AOSP-ExploitUserDictionary AOSP UserDictionary Content Provider용 PoC 익스플로잇 CVE-2018-9375 보안 권고 https://ioactive.com/wp-content/uploads/2018/08/IOActive-Security-Advisory-AOSP-UserDictionaryProvider-v1.0.pdf 추가 정보...

CVE-2024-48652

CVE-2024-48652 camaleon-cms v.2.7.5의 사이트 간 스크립팅Cross Site Scripting 취약점으로 인해 원격 공격자가 콘텐츠 그룹 이름 필드를 통해 임의 코드를 실행할 수 있습니다. 재현 단계: 1.URL을 엽니다: http://127.0.0.1/admin/dashboard 2.관리자 자격 증명으로 로그인합니다. 3."Settings" 섹션으로 이동합니다. 4."Content Groups"를 클릭합니다. 5.콘텐츠 그룹에 대해 "Edit" 옵션을 선택합니다. 6."Name" 필드에 다음 XSS...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin versions before 1.10.2 (specifically versions 1.4.4 through 1.10.1) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to validate the URL scheme of a request-supplied value, which is then reflected into a link on an admi...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

EUVD-2026-94188

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...