Cross-site Scripting (XSS)

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the FormAction field. An attacker can execute arbitrary script in the browser of other users by supplying a malicious titl...

Cross-site Request Forgery (CSRF)

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via insufficient CSRF protection in GridField. An attacker can cause authenticated CMS users to perform unintended...

Incorrect Authorization

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Incorrect Authorization via validation of secure token parameters. An attacker can bypass authentication checks protecting privileged query parameters...

User Impersonation

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to User Impersonation via insufficient validation of proxy-related HTTP headers. An attacker can spoof client IP addresses, hostnames, or protocols by...

Missing Authorization

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Missing Authorization via the buildDefaults action in DevelopmentAdmin. An attacker can perform unauthorized database modifications and obtain...

AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution. Steer the agent to load an attacker's web page, and that page's JavaScript can reach a privileged local service on the same machine and spawn a...

Missing Authorization

Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Missing Authorization in the AuthorizeActionFilter process. An attacker can gain unauthorized access to...

Sentinel

Sentinel — Offensive Web & API Attack Framework Fingerpri...

Command Injection

Overview network-ai is an AI agent orchestration framework for TypeScript/Node.js - 29 adapters LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Compu Affected version...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Media: Amphion – Fixed a race condition between m2mJobAbort and deviceRun. We have fixed a kernel panic that occurred due to a race condition where v4l2m2mCtxRelease releases the m2mCtx while v4l2m2mTryRun is about to call...

CVE-2026-56138

CVE-2026-56138 affects the AIL framework. A path traversal vulnerability exists in the /objects/item/diff endpoint, where an authenticated user can supply item identifiers via the s1 and s2 query parameters. Before the fix, the service could read gzip-compressed files accessible to the AIL proces...

CVE-2026-56138 Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed ...

dotnet: .NET Framework: Denial of Service via improper input validation

A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service DoS condition, making the affected system unavailable to legitimate users...

dotnet: .NET: Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service DoS. An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash...

dotnet: .NET Framework: Denial of Service via network-based buffer overflow

A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service DoS, making the affected system unavailable to legitimate users...

dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service DoS, making the affected system unresponsive ...

dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure

A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system...

dotnet: .NET Framework: Privilege escalation via code injection

A flaw was found in .NET Framework. This vulnerability, caused by improper control of code generation, allows an unauthorized attacker to inject malicious code. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected syste...

CVE-2026-56138: Improper Limitation of a Pathname to a Restricted Directory

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed ...

The vulnerability of the HttpObjectDecoder component in the framework for developing network applications, servers, and client protocols based on Netty allows attackers to compromise the integrity of protected information.

The vulnerability of the HttpObjectDecoder component in the framework for developing network applications, servers, and Netty protocol clients is related to deficiencies in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected...