CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...

CVE-2026-81760

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2...

CVE-2026-81020

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

CVE-2026-81019

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Catena completa n8n Lettura arbitraria di file non autenticata → Forgiatura token admin → Bypass sandbox → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Critico Interessate| = 0.211.0 RCE Corretta| 1.121.0 AFR / 1.120.4+ RCE Divulgat...

BIT-TOMCAT-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, fr...

GHSA-JW39-3688-R4RX Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

GhostLock-for-OnePlus15T

GhostLock — OnePlus 15T Exploit del kernel mirato a dispositivi OnePlus 15T con bootloader bloccato. Utilizza CVE-2026-43499 per ottenere accesso root senza sbloccare il bootloader o modificare boot.img. Solo per scopi autorizzati di ricerca sulla sicurezza e istruzione. Modificato dal repository...

CVE-2022-46463

CVE-2022-46463 Harbor öffentliche Images herunterladen Harbor ist eine Open-Source-Plattform zum Hosten von Container-Images. Dieses Skript listet alle öffentlichen Images auf und unterstützt einen Dump-Vorgang ähnlich docker pull, um das Auffinden sensibler Informationen in öffentlich zugänglich...

Fragnesia-go

fragnesia-go Una SA. Un byte alla volta. Nessuna race. Porting Go di fragnesia CVE-2026-46300. Membro della classe di vulnerabilità Dirty Frag - bug separato, stessa superficie, patch propria. Come funziona tl;dr Il bug si trova nel sottosistema Linux XFRM ESP-in-TCP. Quando TCPULP espintcp viene...

CVE-2020-0023

CVE-2020-0022 ऐसा लगता है कि Android 9-6 में समान ब्लूटूथ सबसिस्टम है, Android 5 और 4 अलग हैं। Android 9.0 BlueFrag प्रयोग पैच: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf नीचे मैंने पैच की गई स्थिति को हिट किया। ठीक है, मुझे लगता है कि मुझे यह म...

Grafana-CVE-2021-43798

CVE-2021-43798 Vulnerabilidade de leitura arbitrária de arquivos não autorizada no Grafana 8.3.1 2021-12-07 Segurança: Corrige CVE-2021-43798. Para mais informações, veja nosso blog https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/...

slipstream

NAT Slipstreaming NAT Slipstreaming permette a un attaccante di accedere da remoto a qualsiasi servizio TCP/UDP associato a qualsiasi sistema dietro il NAT della vittima, bypassando il NAT/firewall della vittima controllo remoto arbitrario dei fori del firewall, semplicemente visitando un sito we...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Umgehung der Microsoft Windows Kerberos-Authentifizierung CVSS-Score: 9.8 Kritisch Status: Aktive Ausnutzung in freier Wildbahn Offenlegung: Microsoft August 2025 Patch Tuesday Zero-Day Übersicht CVE-2025-53779 ist eine kritische Schwachstelle zur Umgehung der Authentifizierung in...

cve-2025-0282-ivanti_rce_reproduction

CVE-2025-0282 — Ivanti Connect Secure / Policy Secure / ZTA Gateways — RCE por Estouro de Buffer Baseado na Pilha CVSS 9.0 — CRÍTICO | Zero-Day Explorado Ativamente | Descoberto em Janeiro de 2025 Visão Geral CVE-2025-0282 é uma vulnerabilidade de estouro de buffer baseado na pilha CWE-121 /...

Crescendo

Inhaltsverzeichnis 1. Einstieg 2. Anforderungen 3. Komponenten 4. Testen und Entwicklung 5. Signieren 6. Erstellen 7. Probleme/Fehler/Funktionen 8. Fehlerbehebung 9. TODO Einstieg Apple hat einige neue Sicherheitsmechanismen eingeführt, die wir aktivieren müssen, um Crescendo zum Laufen zu bringe...

cve_2026_31431

Toolkit CVE-2026-31431 "Copy Fail" Detector e proof-of-concept di LPE per il bug di scratch-write nella page cache di Linux algifaead / authencesn divulgato il 29 aprile 2026. Analisi della divulgazione: https://xint.io/blog/copy-fail-linux-distributions Autorizzazione Utilizzare solo su host di...

CVE-2026-33340

CVE-2026-33340: SSRF in lollms-webui Panoramica Campo| Dettaglio ---|--- CVE ID| CVE-2026-33340 Vulnerabilità| Server-Side Request Forgery SSRF Prodotto interessato| ParisNeo/lollms-webui LoLLMs WEBUI Gravità| Critica — CVSS 9.1 Vettore CVSS| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE|...