CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit for CVE-2026-89012: the forbidden-fields denylist in forgeSQLFromUniversalSearchCriteria introduced with the CVE-2026-71510 fix uses a case-sensitive inarray while the operand charset allows A-Z. Since SQL column resolution is...

wordlist_generator

wordlistgenerator La herramienta wordlistgenerator genera una lista de palabras única para tu objetivo utilizando las técnicas mencionadas en el video de tomnomnom "Who, What, Where, When". Toma URLs de gau para extraer directorios, nombres de archivo o palabras de las páginas. Como característic...

CVE-2026-69263

CVE 2026-69263 What CVE 2026-69263 is a patch bypass of the old RCE vulnerability patched back in August of 2025. The patch introduced a Denylist that blocked installation of arbitrary packages. How Since npm reads config from environment variables, setting the npmconfigyes=true environment...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect Pre-Auth RCE Pre-authenticated Remote Code Execution in NextGen Healthcare Mirth Connect CVSS 9.8 Critical — Patch bypass of CVE-2023-37679 Overview Mirth Connect uses the Java XStream library to deserialize XML payloads on the /api/users endpoint without...

NPM: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

NPM: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

EUVD-2026-81607

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

PT-2026-105802

Impact When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password the hash, privilege flags e.g. is staff / is superuser, tokens, and other PII to the browser. Because exposing model...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-3149)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3149 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-425...

GHSA-GX83-3VF8-GH7J jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

Summary DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" Object, Serializable, Closeable, AutoCloseable,...

CVE-2026-101087 Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because...

CVE-2026-101087 Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because...

CVE-2026-101087

Nezha versions 2.0.10 through 2.3.2 are vulnerable to a server-side request forgery (SSRF) denylist bypass. The software uses a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist fails to include specific IPv6 transition ranges, namely the 6t...

PT-2026-99304

Name of the Vulnerable Software and Affected Versions SiYuan versions 3.8.0 through 3.8.3 Description An authenticated administrator using the in-app Agent or the external MCP server can bypass the protected-workspace-file denylist. This occurs because the sensitive-path guard...

Exploit for CVE-2026-75827

abraxaslabs.tech · github.com/abraxas ·&...

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...

GHSA-F8WV-XP27-6GQ7 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...

EUVD-2026-60591

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits errorlog, giving arbitrary file write...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

CVE-2026-92958

A flaw was found in vm2, a sandbox for Node.js. When the NodeVM embedder uses a builtin wildcard with negative entries to deny specific modules, such as 'fs' for file system access, the denylist mechanism fails to block subpaths like 'fs/promises'. This allows sandboxed code to bypass the intende...