212493 matches found
PT-2026-84256
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uri string:get port/1 passes the port substring to binary to integer/1 with no length bound,...
PT-2026-84302
GROWI contains an access control vulnerability in the GET / api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...
PT-2026-84462
Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1 Description An attacker can craft a PDF file that causes the get outline function in pypdf/ doc common.py to consume excessive memory and long runtimes. This occurs when retrieving document outlines that contain ...
TencentOS Server 4: grafana (TSSA-2026:0869)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0869 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
Grav CMS 2.0.7 - RCE
!/usr/bin/env python3 Exploit Title: Grav CMS 2.0.7 - Remote Code Execution Date: 2026-07-27 Exploit Author: zer0dayf Vendor Homepage: https://getgrav.org/ Software Link: https://github.com/getgrav/grav Version: Grav CMS 2.0.7 Tested on: Ubuntu 22.04 / PHP 8.2 CVE : CVE-2026-65008 """...
This Week in Spring - September 1st, 2026
Hi, Spring fans! Welcome to another exciting installment of This Week in Spring! I'm writing this from lovely Oslo, Norway, for the joyous JavaZone conference. Next, I'm going to Amsterdam for the interesting IntelliJ IDEA conference, and then finally it's off to Kansas City for the kinetic KCDC...
EasyAppointments 1.5.1 Blind SQL Injection
A blind SQL injection vulnerability exists in the orderby parameter of the /index.php/customers/search endpoint in EasyAppointments versions 1.5.1 and below. The parameter is passed unsanitized to CodeIgniter 3 Query Builder orderby. Parenthesized subqueries bypass backtick escaping via CI3's...
proxy v0.7.0
git-pkgs proxy A caching proxy for package registries. Speeds up package downloads by caching artifacts locally, reducing bandwidth usage and improving reliability. Version Cooldown Most supply chain attacks rely on speed: a malicious version gets published and consumed by automated pipelines...
CVE-2026-82882
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...
aotopsy v1.1.0
AOTopsy A Dart AOT snapshot analyzer. Turns libapp.so — the compiled Dart code inside a Flutter release APK — into function names, class layouts, call graphs, behavioral signals, and readable pseudocode. No Dart VM, no SDK compilation, no runtime fallback. Fork notice: AOTopsy is a fork of...
CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...
CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...
CVE-2026-82882
Devtron versions through 2.2.0 fail to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint. Any user with a valid authenticated account can query this endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens...
CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...
GHSA-FM3F-CH8H-QW8Q @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...
GHSA-8X3Q-JPJH-QH5C elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...
