CVE-2026-84363

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL, reverse proxies,...

CVE-2026-84365

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

EUVD-2026-69650

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981

Cypht versions before 2.12.2 contain a PHP object injection vulnerability in the logout handler. The back_query GET parameter accepts a base64-encoded serialized payload that is passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exp...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

GHSA-M4RF-3FR8-XWX3 NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Vulnerability The fix for CVE-2026-12841 CWE-88, JVM argument injection added validatejavaoptions to block dangerous JVM flags such as -agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references. However, the validation is only applied when setting global options via configjava. The jav...

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Vulnerability The fix for CVE-2026-12841 CWE-88, JVM argument injection added validatejavaoptions to block dangerous JVM flags such as -agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references. However, the validation is only applied when setting global options via configjava. The jav...

Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. Python is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fixes...

CVE-2026-84365

Hono (a JavaScript web framework) has an incomplete fix for CVE-2026-39408 in its toSSG() static site generation method, affecting versions from 4.12.12 and fixed in 4.13.5 . The path normalization routine used to verify output paths does not fully collapse runs of consecutive parent-directory se...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84363 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL, reverse proxies,...

CVE-2026-84363

Hono is a web application framework for any JavaScript runtime. Prior to 4.13.5 , its query helpers treat a question mark after a literal hash fragment as the start of a query string, allowing the application to read request parameters that browsers, reverse proxies, filtering rules, and other mi...

CVE-2026-84363 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL, reverse proxies,...

CVE-2026-84363 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL, reverse proxies,...

WordPressMassExploiter

WordPressMassExploiter Mass exploiter of CVE-2015-1579 for WordPress CMS This mass exploiter is based on CVE-2015-1579, discovered by CLAUDIO VIVIANI https://www.exploit-db.com/exploits/36554/ How it works: 1 - I use Selenium Framework to make the search on google. 2 - The results of search, are...