24197 matches found
CVE-2026-2578 Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts
Mattermost versions 11.3.x = 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermost Advisory ID: MMSA-2026-00579...
CVE-2026-2578 Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts
Mattermost versions 11.3.x = 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermost Advisory ID: MMSA-2026-00579...
CVE-2026-2578
Mattermost (version 11.3.x, affected range up to 11.3.0) has a vulnerability where the redacted state of burn-on-read posts is not preserved during deletion. This allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event. CVSS v3.1 base score ...
Event-Driven Vulnerability Exposure Management (VEM): Why you should move beyond Human Triggers
& The traditional approach to vulnerability management has long followed a familiar pattern: security teams log into their vulnerability management platforms, run scans, generate reports, analyze findings, and then prioritize remediation efforts. Rinse and repeat. While this on-demand model has...
(Pwn2Own) QNAP TS-453E nvrlog_event_add msg SQL Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling ...
CVE-2026-28490
creationtimestamp| type| source ---|---|--- 2026-03-15 17:48:25+00:00| published-proof-of-concept| https://github.com/authlib/authlib/security/advisories/GHSA-7432-952r-cw78 2026-03-16 18:10:06+00:00| seen| https://gist.github.com/alon710/2d123731c9da93f7319d6377d20965fd...
CVE-2026-28521
arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information...
Deserialization of Untrusted Data
Overview org.apache.spark:spark-core2.12 is an unified analytics engine for large-scale data processing. It provides high-level APIs in Scala, Java, Python, and R, and an optimized engine that supports general computation graphs for data analysis. It also supports a rich set of higher-level tools...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Jackson implementation in the Spark History Server web UI. An attacker who can write event logs can achieve code execution by injecting malicious JSON payloads into event log files, which are the...
CVE-2025-54920
This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...
CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability
This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...
CVE-2025-54920
The CVE-2025-54920 entry describes a code execution vulnerability in Apache Spark prior to 3.5.7 and 4.0.1, originating from the Spark History Server’s oversized Jackson deserialization of event log data. The issue uses Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListe...
CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability
This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...
GHSA-5M9R-P9G7-679C
creationtimestamp| type| source ---|---|--- 2026-03-14 04:10:06+00:00| seen| https://gist.github.com/alon710/aed471f71d18a585b1ac6741c86dd8af 2026-03-31 13:19:26+00:00| published-proof-of-concept| Telegram/bc0dtnMAVwN1UZgcMoKZPcvjFdUYL45B0PcMRVU30Ps4cSo...
Apache Spark 代码问题漏洞
Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...
PT-2026-25504
This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...
CVE-2026-32722
creationtimestamp| type| source ---|---|--- 2026-03-13 22:01:26+00:00| published-proof-of-concept| https://github.com/bloomberg/memray/security/advisories/GHSA-r5pr-887v-m2w9 2026-03-20 09:00:06+00:00| seen| https://bsky.app/profile/concisecyber.bsky.social/post/3mhi5onwafp26...
EUVD-2026-11997
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through = 1.3.4...
EUVD-2026-11842
Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through 5.1.9...