RECON: An LLM-Enhanced Backward Constraint Analysis Framework

While traditional techniques, such as symbolic execution, provide a principled foundation for precise constraint reasoning in program analysis, they struggle to scale to modern software systems mainly due to path explosion, the need for function modeling, and the loss of semantic intent at...

📄 Revive Adserver 6.0.6 XSS / SQL Injection / Code Execution

Revive Adserver versions 6.0.6 and below exploitation framework that targets cross site scripting, remote SQL injection, remote code execution, and various other vulnerabilities...

ROS-20260608-73-0009

The vulnerability of the .NET software platform is related to insufficient testing of output data. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20260608-73-0017

The vulnerability of the Microsoft .NET software platform, Microsoft .NET Framework, and the source code editor Visual Studio is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0 <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0) +13926 more potentially affected by CVE-2026-41845 via org.springframework:spring-web (>=6.1.0 <=6.2.18)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.6.0, =0.6.0, =0.5.0, =0.8.7 and more Source cves: CVE-2026-41845 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17255245...

africa.absa:inception-api (>=1.0.0 <=1.2.0), africa.absa:inception-application (>=1.0.0 <=1.2.0) +16935 more potentially affected by CVE-2026-41839 via org.springframework:spring-web (>=5.3.0 <=5.3.9)

org.springframework:spring-web MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =4.6.0.0 - ai.apiverse:apipulse =1.0.1 and more Source cves: CVE-2026-41839 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254128...

africa.absa:inception-api (>=1.0.0 <=1.2.0), africa.absa:inception-application (>=1.0.0 <=1.2.0) +16935 more potentially affected by CVE-2026-41845 via org.springframework:spring-web (>=5.3.0 <=5.3.9)

org.springframework:spring-web MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =4.6.0.0 - ai.apiverse:apipulse =1.0.1 and more Source cves: CVE-2026-41845 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17255245...

africa.absa:inception-api (>=1.0.0 <=1.2.0), africa.absa:inception-application (>=1.0.0 <=1.2.0) +16935 more potentially affected by CVE-2026-41853 via org.springframework:spring-web (>=5.3.0 <=5.3.9)

org.springframework:spring-web MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =4.6.0.0 - ai.apiverse:apipulse =1.0.1 and more Source cves: CVE-2026-41853 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254109...

📄 WordPress Burst Statistics 3.4.1.1 Authentication Bypass

WordPress Burst Statistics plugin versions 3.4.0 through 3.4.1.1 authentication bypass to administrative takeover exploitation framework. ================================================================================================================================== | Title : WordPress 3.4.1.1...

biz.eyebeam.mssc:mssc-public-bom (>=1.0.1 <=1.0.12), br.com.faroltech:mssc-brewery-bom (>=1.0.3 <=1.0.5) +756 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (>=5.3.0 <=5.3.9)

org.springframework:spring-jms MAVEN version =5.3.0, =1.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =4.3.0, =4.3.0, =4.3.0, =4.3.0, =4.3.0, =4.3.0, =4.3.0, =4.7.0 and more Source cves: CVE-2026-41855 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254113...

ROS-20260608-73-0006

The vulnerability of the .NET software platform lies in the execution of a loop with an exit condition that is not met. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Medium: capstone

Issue Overview: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStreamconcat lets a malicious csoptmem.vsnprintf drive SStream's index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Comm...

Spring Framework Denial of Service via AntPathMatcher

Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher :...

Amazon Linux 2023 : capstone, capstone-devel, capstone-java (ALAS2023-2026-1772)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1772 advisory. Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStreamconcat lets a malicious csoptmem.vsnprintf drive SStream's index negative or past the en...

RHEL 10 : .NET 8.0 (RHSA-2026:24332)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24332 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

RHEL 9 : .NET 8.0 (RHSA-2026:24335)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24335 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

jflyfox jfinal_cms 注入漏洞

jfinalcms is a content management system used for managing website sections, articles, and feedback content. jflyfox jfinalcms has a SQL injection vulnerability. The vulnerability arises due to the list function in the AdvicefeedbackController.java file not properly filtering the orderBy paramete...

VulnLinux-Exploitation

Lab 01: Vulnerable Linux Reconnaissance + Enumeration + Remote...

Data Agents under Attack: Vulnerabilities in LLM-Driven Analytical Systems

Data agents integrate LLM-driven reasoning with relational data access, executable analytical tools, and multi-step workflow orchestration, making them increasingly central to enterprise analytics. This integration introduces new security vulnerabilities across data resources, database execution,...

@poppies/egg-poppy-api-framework (=1.0.2), egg-poppy-customized-framework (>=1.0.1 <=1.0.5) +2 more potentially affected by unknown CVE via creditcard.js (=2.1.6)

creditcard.js NPM version =2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on creditcard.js and may be impacted: - @poppies/egg-poppy-api-framework =1.0.2 - egg-poppy-customized-framework =1.0.1, =1.0.2, =1.0.1, =1.0.2 Source cves: unknown CVE Sourc...