44672 matches found
The vulnerability of the Business Connectivity Services (BCS) framework in Microsoft SharePoint Server and SharePoint Enterprise Server allows a perpetrator to execute arbitrary code.
The vulnerability of the Business Connectivity Services BCS framework in Microsoft SharePoint Server and SharePoint Enterprise Server stems from the insecure creation of .NET types through insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary...
CVE-2026-49455: Cross-Site Request Forgery (CSRF)
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...
CVE-2026-85012: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...
EUVD-2026-69647
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default...
joro v1.12.0
Joro A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI. Warning: This tool is intended for authorized penetration testing an...
CLSA-2026-1788376116 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.4...
CLSA-2026-1788372470 TuxCare security update for org.springframework (21 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 21 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.4...
CVE-2026-53649 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScrip...
CVE-2026-52832
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...
CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...
EUVD-2026-70220
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
CVE-2026-79754 Nuclio: Kaniko build tempDir command injection
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...
CVE-2026-52833 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...
CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...
CLSA-2026-1788363279 TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.10...
CLSA-2026-1788362569 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 26 org.springframework packages to address 1 CVE. Fixed in 6.1.4-tuxcare.3...
CLSA-2026-1788361436 TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 13 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.10...