CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

EUVD-2026-104576

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-106587

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon sshd incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by...

CVE-2026-69805

A flaw was found in .NET. An unauthorized attacker can exploit this vulnerability by gaining external control of a file name or path, which allows them to elevate privileges over a network...

CVE-2026-96237

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

External Control of File Name or Path

Overview docling-core is an A python library to define and validate data types in Docling. Affected versions of this package are vulnerable to External Control of File Name or Path via withembeddedpictures and ImageRef when exporting a DoclingDocument containing untrusted content. Plain filesyste...

CVE-2026-19197

A flaw was found in Grafana. This broken access control vulnerability allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations on the same Grafana instance. Furthermore, the flaw enables the recovery of a snapshot's secret delete key...

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept PoC went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involve...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition,Version 8 used by AIX. AIX has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2025-7043

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...

GHSA-F8C7-RWF9-FMGM Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Summary A missing comma in mercuryapp/blockhandler.py's BLOCKEDPATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in...

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Summary A missing comma in mercuryapp/blockhandler.py's BLOCKEDPATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in...

External Control of File Name or Path

Overview graphifyy is an AI coding assistant skill Claude Code, CodeBuddy, Codex, OpenCode, Kilo Code, Cursor, Gemini CLI, Aider, OpenClaw, Factory Droid, Trae, Hermes, Kiro, Pi, Devin CLI, Google Antigravity - turn any folder of code, docs, papers, images, or videos into a queryable knowledge...

EUVD-2025-211116

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...

GHSA-VX2M-GPQ4-8J5Q LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...

EUVD-2026-103186

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files...

CVE-2026-111057 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKEDPATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint...

CVE-2026-111057 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKEDPATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint...

CVE-2026-111057

The Mercury Python framework (versions 3.0.0 to 3.2.3 ) is vulnerable to an access control bypass due to a missing comma in the BLOCKED_PATTERNS variable. This error concatenates the /lab and /api/terminals regular-expression literals, allowing unauthenticated requests to /api/terminals to bypass...