67436 matches found
CVE-2026-39725
...
io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...
CVE-2026-39599
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
CVE-2026-39599 WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
CVE-2026-39599
The WDS MCP Content Manager WordPress plugin affects versions
EUVD-2026-92953
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
CVE-2026-39599 WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
Exploit for Improper Handling of Exceptional Conditions in Apache Struts
Struts Patch-Gap Auditor A small Python tool that finds Apach...
XworkStruts-RCE
XworkStruts-RCE CVE-2017-5638 XworkStruts RCE 漏洞测试脚本 Apache Struts 2 2.3.x（2.3.32 之前）和 2.5.x（2.5.10.1 之前）中的 Jakarta Multipart 解析器在文件上传尝试期间存在错误的异常处理和错误消息生成，从而使远程攻击者能够通过精心构造的 Content-Type、Content-Disposition 或 Content-Length HTTP 头执行任意命令。该漏洞已于 2017 年 3 月在野外被利用，攻击者使用的 Content-Type 头中包含 cmd= 字符串。 用法...
CVE-2026-26980
CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL注入PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c 概述 CVE-2026-26980 是 TryGhost Ghost CMS Content API 中的一个未经认证的 SQL 注入漏洞。当处理 slug:... 排序时，可通过公共 Content API 过滤逻辑访问受影响路径。 该 PoC 构建了一个受控的 Ghost 6.19...
CLEANSTART-2026-LH05062 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
Security vulnerability affects the sonarqube package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
CLEANSTART-2026-MX72137 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute
Security vulnerability affects the temporal-server package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...
CLEANSTART-2026-NX24657 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name
Security vulnerability affects the rundeck package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...
PT-2026-106412
Contributor Remote Code Execution RCE in Content Visibility for Divi Builder = 5.03 versions...
PT-2026-107279
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper input validation within cloud storage URL readers. An attacker possessing write access to a cloud storage bucket utilized by the framework...
PT-2026-106721
Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...
PT-2026-106327
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
PT-2026-106733
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parse header parameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...
Linux Distros Unpatched Vulnerability : CVE-2026-84429
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential...