PT-2026-107704

Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration CWE, with one Common Vulnerabilities and Exposures...

PT-2026-107602

Name of the Vulnerable Software and Affected Versions Cisco Meraki affected versions not specified Description Improper access control issues were identified during an internal security review. These issues are categorized under CWE-284, which refers to improper access control, where a software...

PT-2026-107611

Name of the Vulnerable Software and Affected Versions Cisco License On-Prem affected versions not specified Description Issues with improper authentication were identified in Cisco License On-Prem, formerly known as Cisco Smart Software Manager On-Prem. These issues fall under the Common Weakness...

PT-2026-107618

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC affected versions not specified Description Improper access control issues exist within the system, categorized under CWE-284, which refers to the improper enforcement of authorization...

PT-2026-107619

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC affected versions not specified Description Improper neutralization issues exist within the software, which are categorized under the Common Weakness Enumeration CWE Pillar CWE-707. This...

PT-2026-107620

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC affected versions not specified Description An issue exists involving improper control of a resource through its lifetime. This relates to CWE-664, which occurs when a software system doe...

CVE-2026-106063 Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width height and bytes-per-pixel product that can overflow. GEGL then writes the full uncompressed extent into th...

CVE-2026-106063 Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width height and bytes-per-pixel product that can overflow. GEGL then writes the full uncompressed extent into th...

CVE-2026-106063

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width height and bytes-per-pixel product that can overflow. GEGL then writes the full uncompressed extent into th...

cve-2026-105221-gist-tls

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-105221-gist-tls cve-2026-105221-gist-tls gist RubyGem 6.1.0 - defunkt httpconnection establece OpenSSL::SSL::VERIFYNONE. HTTPS hacia GitHub sigue cifrando, pero se acepta cualquier certificado. Un par en la...

Security Bulletin:Jackson-Databind Denial-of-Service Vulnerability in Versions 2.13.0 to 2.14.0

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if and only if the service reads deeply nested 1000s of levels JSON as...

CVE-2022-0482_exploit

CVE-2022-0482 漏洞利用 简介 本文档详细分析了 CVE-2022-0482，这是 Easy!Appointments 预约管理软件中存在的一个严重安全漏洞。该漏洞属于 CWE-863 下的授权不正确，允许未经授权的人员在无需适当认证的情况下访问个人身份信息，对数据的机密性和完整性构成重大风险。 作者 Mija Pilkaite 漏洞概述 CVE-2022-0482 影响 Easy!Appointments 1.4.3 之前的版本。该漏洞由 Francesco Carlucci 于 2022 年 1 月 30...

CVE-2026-46394-haxcms-git-command-injection

CVE-2026-46394 - HAXcms Git.php 操作系统命令注入 CWE-78 仅用于授权安全测试和研究的概念验证。 此处描述的漏洞已在 HAXcms 的最新版本中修复 。 发布此 PoC 是为了让防御者和研究人员能够在他们拥有或明确获准测试的未打补丁实例上验证该问题。 | ---|--- CVE| CVE-2026-46394 组件| HAXcms PHP 后端 - system/backend/php/lib/Git.php 漏洞| 操作系统命令注入 CWE-78 严重性| 高危 - CVSS 3.1 7.2 独立 / 8.1 结合路径遍历 状态|...

CVE-2026-46395-haxcms-hmac-key-leak

CVE-2026-46395 - HAXcms Node.js 因 HMAC 缺陷导致的私钥泄露 CWE-321 / CWE-200 仅限授权安全测试与研究的概念验证。 此处描述的漏洞已在 HAXcms 最新版本中修复 。 本 PoC 的发布是为了让防御者和研究人员能够在其拥有或明确授权测试的未打补丁实例上验证此问题。 | ---|--- CVE| CVE-2026-46395 组件| HAXcms Node.js 后端 - haxcms-nodejs/src/lib/HAXCMS.js 漏洞| 硬编码加密密钥 + 私钥泄露 CWE-321, CWE-200 严重性| 严重 - CVSS...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

安全公告：访问控制不足导致未授权删除房间（Let's Chat） 分配的 CVE 编号： CVE-2026-66751 摘要 DELETE /rooms/:room 除了要求登录之外，不执行任何授权检查。任何账户都可以归档服务器上的任意房间，包括该账户无权读取、加入或修改的私有房间和密码保护房间。 归档就是 Let's Chat 删除房间的方式。房间会从房间列表中消失，直接查找返回 404，向其发布消息或上传文件也会被拒绝。应用程序中没有任何代码路径可以撤销此操作。 受影响版本 仓库 URL：https://github.com/sdelements/lets-chat 从 0.3.0（...

Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in xmldom

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in xmldom. CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83610, CVE-2026-83611, CVE-2026-83613, CVE-2026-83614, CVE-2026-83615, CVE-2026-83616, CVE-2026-83619 The vulnerabilities have been addressed...

CVE-2026-25089

🚨 CVE-2026-25089 - FortiSandbox 关键操作系统命令注入漏洞 📖 概述 CVE-2026-25089 是影响多个 Fortinet FortiSandbox 部署的一个关键 操作系统命令注入（CWE-78） 漏洞。 未经身份验证的远程攻击者可通过发送特制 HTTP 请求利用此缺陷，从而在底层操作系统上执行任意命令。 ⚠️ 成功利用可能导致设备完全沦陷及远程代码执行（RCE）。 🎯 漏洞详情 字段| 值 ---|--- CVE| CVE-2026-25089 严重性| Critical CWE| CWE-78 攻击类型| 操作系统命令注入 认证| 不需要 用户交互...

CVE-2025-68664-LangGrinch-PoC

!CWEhttps://img.shields.io/badge/CWE--502-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96-informational?style=for-the-badge&logo=owasp&logoColor=whit...

CVE-2026-46376

CVE-2026-46376 — FreePBX 未授权UCP访问（硬编码凭据） FreePBX 用户管理（userman）模块中的一个严重漏洞，允许未经身份验证的攻击者使用在 UCP 通用模板设置过程中嵌入的硬编码凭据访问用户控制面板（UCP）。 CVSS v4.0: 9.1（严重） | CWE-798: 使用硬编码凭据 披露时间：2026年5月15日 | 报告者：s0nnyWT 详情 当管理员使用可选的 UCP 通用模板设置功能（2021 年引入）时，会创建一个系统用户 FreePBXUCPTemplateCreator，其密码为硬编码、静态的...

CVE-2026-84388-POC

Capa de UI de la extensión de Chrome de FortiPAM RCE PoC - CVE-2026-84388 Descripción general Este repositorio contiene un exploit de prueba de concepto para CVE-2026-84388 Restricción inadecuada de capas o marcos de UI renderizados, CWE-1021. La vulnerabilidad en la extensión de Chrome de Fortin...