CLEANSTART-2026-SB20243 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-nifi-registry package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-SS30538 Echo is a Go web framework

CVE-2026-55677 affects multiple packages. Echo is a Go web framework. See references for individual vulnerability details...

CVE-2022-22965-Spring4Shell-Security-Operations-Analysis

CVE-2022-22965 — Spring4Shell Security Operations Analysis A hands-on Security Operations Centre SOC simulation where I performed the role of an Information Security Analyst responding to an active Spring4Shell exploitation attempt. This repository documents the full incident response lifecycle —...

PT-2026-107799

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

PT-2026-107778

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA Authentication, Authorization, and Accounting integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific...

CVE-2025-55182

CVE-2025-55182 React JavaScript 프레임워크의 RCE 취약점에 대한 호스트 기반 탐지 규칙입니다...

EUVD-2026-91668

Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages...

EUVD-2026-93516

Quasar Framework: DOM Clobbering in Quasar openURL SafariViewController Integration Causes Client-Side Denial of Service...

GHSA-89VP-X45C-52CQ Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Summary A DOM Clobbering vulnerability exists in Quasar's openURL utility when handling the iOS SafariViewController bridge. The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content...

NPM: Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

NPM: Quasar Framework: DOM Clobbering in Quasar openURL SafariViewController Integration Causes Client-Side Denial of Service vulnerability discovered by ? in WordPress Npm quasar versions = 2.32.1...

coruna

Coruna — iOS Safari Sandbox Escape & Post-Exploitation C2 Fram...

Security Bulletin:React Router SSR Error Handling Vulnerability in Versions 6.4.0 to 7.17.0

Summary React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor...

EUVD-2026-94008

Backstage: Improper authorization enforcement for TechDocs static content...

CVE-2026-80843

A flaw was found in the Linux kernel's xfrm IPSec framework component. This vulnerability occurs when the xfrmstateconstruct function incorrectly manages memory allocations for authentication algorithms. Specifically, it can overwrite an existing allocation, leading to a memory leak. Over time,...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 バリデーションルールインジェクション CVE-2023-32692 は、CodeIgniter 4 PHP フレームワークにおけるコードインジェクションの脆弱性で、バージョン 4.0.0 から 4.3.4 に影響します。これは 4.3.5 （2023年6月リリース）で修正されました。このリポジトリは、この脆弱性を試してみたい人向けのデモ環境です。 脆弱性の詳細は MOGWAI LABSブログ で確認できます。 PoC 環境 このリポジトリには、この脆弱性を実証する最小限のCodeIgniter...

EUVD-2026-93570

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions...

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

The @quasar/ssl-certificate development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesyst...

GHSA-FH39-C73X-5PJV Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

The @quasar/ssl-certificate development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesyst...

EUVD-2026-93571

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable...

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...