46335 matches found
CVE-2026-44374
Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless o...
EUVD-2026-30295
Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless o...
CVE-2026-41935
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init repeatedly invokes permission on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin...
portofolio_DWForSec
DwF — Cybersecurity Portfolio A professional cybersecurity po...
WS-2019-0477
Slush-fullstack-framework v0.9.2 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...
offsec-skills
offsec-exploit-research Elite adaptive whitebox exploit resea...
Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation
An anonymous cybersecurity researcher who disclosed three Microsoft Defender vulnerabilities has returned with two more zero-days involving a BitLocker bypass and a privilege escalation impacting Windows Collaborative Translation Framework CTFMON. The security defects have been codenamed YellowKe...
app-state (>=0.3.0, <=2.0.1), grasshopper-framework (0.0.0-alpha.5) +3 more potentially affected by unknown CVE via get-setter (0.0.0)
get-setter NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on get-setter and may be impacted: - app-state =0.3.0, =0.0.0, =0.0.1 - immutable-model-object 0.0.0 - model-object 0.0.0 Source cves: unknown CVE Source advisory: MEND:WS-2020-0...
WS-2019-0037
django-rest-framework versions before 3.9.1 has an XSS vulnerability caused by disabled autoescaping in the default DRF Browsable API view templates...
albot (>=0.12.0, <=0.14.1), background-functions (>=1.0.0, <=1.0.4) +2 more potentially affected by unknown CVE via funcster (>=0.0.2, <=0.0.3)
funcster NPM version =0.0.2, =0.12.0, =1.0.0, =0.5.3, =0.0.1, =0.0.4 Source cves: unknown CVE Source advisory: MEND:WS-2018-0152...
Linux Distros Unpatched Vulnerability : CVE-2026-42583
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size...
PT-2026-41160
Name of the Vulnerable Software and Affected Versions Marten versions prior to 8.36.1 Description Marten's full-text search APIs interpolate the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation. This creates a SQL injection sink in any code...
Linux Distros Unpatched Vulnerability : CVE-2026-42577
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP...
PT-2026-40970
Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0 Description A denial-of-service DoS issue exists in the gRPC Launcher "PublishLogs" endpoint. Certain unexpected input values are not handled gracefully, which can cause the server process to terminate while...
Cowboy: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. cowboyreq:readpart/3 in src/cowboyreq.erl accumulates incoming request bytes into a Buffer binary with no upper-bound chec...
PYSEC-2026-160
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service DoS attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending...
smart-app-framework (>=2.4.0rc13, <=2.4.0rc14) potentially affected by CVE-2026-42304 via twisted (26.4.0rc2)
twisted PYPI version 26.4.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - smart-app-framework =2.4.0rc13, =2.4.0rc14 Source cves: CVE-2026-42304 Source advisory: OSV:PYSEC-2026-160...
carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2026-42304 via twisted (19.7.0)
twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2026-42304 Source advisory: OSV:PYSEC-2026-160...
PYSEC-2026-160
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service DoS attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending...
CVE-2026-44372 Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta...