44753 matches found
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...
cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService...
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder...
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController...
PT-2026-78950
Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...
CTFd v3.8.7
What is CTFd? CTFd is a Capture The Flag framework focusing on ease of use and customizability. It comes with everything you need to run a CTF and it's easy to customize with plugins and themes. Features Create your own challenges, categories, hints, and flags from the Admin Interface Dynamic...
CVE-2026-68899 Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback
Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...
CVE-2026-68561 Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...
exploit-development-framework
Exploit Development Framework EDF A modular, educational ex...
lamda v10.6
FIRERPA Android ｜ AI-Powered Automation An all-in-one Android automation framework that combines on-device services, AI-ready agents, and extensible tool invocation. Documentation | 使用文档 | TELEGRAM | QQ Group | SKILLS | llms-full.txt | 中文版本 FIRERPA is an all-in-one Android device control platform...
CVE-2026-72451
A flaw was found in the Linux kernel's xfrm IPSec framework component. A race condition exists in the xfrm state cache insertion logic. This occurs because the validity of a state is checked before a global lock is acquired, allowing another process to invalidate the state before it is added to t...
MINI-MCWM-R84M-MVWM
Bulletin has no description...
WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Golo Framework versions 1.7.5...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services Enterprise modules. These vulnerabilities exist in third-party products such as Apache Kafka, Log4j, and the Spring Framework. Updates have been released by the developers for these products. These updates are now integrated into...
Vulnerabilities in Oracle Database Products
Oracle has identified vulnerabilities in various database products, including the Database Server, Essbase, Autonomous Health Framework, and Oracle Application Testing Suite. The Oracle Database Server versions 19.3 to 23.26.3 contains critical vulnerabilities in the RDBMS and Portable Clusterwar...
CVE-2026-76164
AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...