CVE-2026-29077

Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0...

CVE-2026-28436

CVE-2026-28436 : Frappe (a full-stack web application framework) is affected prior to versions 16.11.0 and 15.102.0. A crafted image URL can trigger stored XSS when avatars are displayed, and the payload can be triggered for other users via website page comments. The issue’s underlying cause is a...

CVE-2026-28436 Frappe: Stored XSS in avatar_macro.html

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 an...

CVE-2026-28436 Frappe: Stored XSS in avatar_macro.html

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 an...

EUVD-2026-9878

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 an...

CVE-2026-28436

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 an...

carton-mcp (>=0.1.80, <=0.1.83), cave-harness (0.1.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.2.60)

langgraph PYPI version 0.2.60 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - carton-mcp =0.1.80, =0.1.24, =0.4.0, =0.1.3, =0.1.0, =0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

carton-mcp (>=0.1.80, <=0.1.83), cave-harness (0.1.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.2.60)

langgraph PYPI version 0.2.60 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - carton-mcp =0.1.80, =0.1.24, =0.4.0, =0.1.3, =0.1.0, =0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

A flaw was found in Netty. With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service...

poc-step-finance-2026

Step Finance Stake Authority Compromise — PoC Educational...

EUVD-2026-9812

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628

The CVE-2026-21628 entry concerns the Astroid Framework integration with Joomla. A vulnerable, improperly secured file management feature allows unauthenticated users to upload dangerous data types, enabling remote code execution. Affected: Astroid Framework for Joomla versions 2.0.0 through 3.3....

CVE-2026-28542

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-28542

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-28542

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-28542

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-28542

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-28542

A CVE entry for CVE-2026-28542 describes a permission bypass in the system service framework. The vulnerability is local (attack vector: LOCAL) with low attack complexity and no required privileges, and it could affect availability (C: High, I: Low, A: Low) per CVSS v3.1 (score 7.3, HIGH). The de...