44688 matches found
CVE-2026-82634
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
CVE-2026-82634
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
CVE-2026-82634
Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint (file: print_format_generator.py). Low-privileged users with print permission on any document can supply raw Jinja template strings, enabling arbitrary SELECT statements against unrelated table...
EUVD-2026-68202
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
CVE-2026-80227
ash-project ash_sql (Elixir) contains an incorrect comparison vulnerability in its string_trim/1 function, affected from 0.1.0 before 0.7.1 . The root cause is that string_trim/1 compiles to a REGEXP_REPLACE pattern where \s resolves to a single space (codepoint 32) rather than the regex whitespa...
CVE-2026-82634: Incorrect Authorization
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
PT-2026-83554
Frappe Framework development builds contain an authorization flaw in the render jinja template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
Debian dsa-6478 : python3-starlette - security update
The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6478 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6478-1 [email protected] https://www.debian.org/securit...
vajra
██╗ ██╗ █████╗ ██╗██████╗ █████╗ ██║ ██║██...
SecureForce
SecureForce - Penetration Testing Framework A simplified but...
Malicious Package
Overview framework-zero is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in framework-zero (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...
MAL-2026-15500 Malicious code in framework-zero (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...
CVE-2026-55485
creationtimestamp| type| source ---|---|--- 2026-08-28 20:35:29+00:00| published-proof-of-concept| https://github.com/piccolo-orm/piccoloadmin/security/advisories/GHSA-2gh4-jmwq-rr8w 2026-08-30 12:02:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucduenvgk2z...
CVE-2026-55484
ALOS HTTP , a Linux-first Go web framework with a custom networking stack, is vulnerable to an unauthenticated remote denial-of-service . The root cause is an unchecked p[0] access in core/utils.go::sanitizeRequestPath after splitPathQuery processes a path beginning with a question mark, leaving ...
CVE-2026-55484 ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p0 access...