Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

cats

CATS documentation is available at https://endava.github.io/cats/ REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort! Comprehensive : tests are generated automatically based on a large number scenarios and cover every field and...

opentaint

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...

CVE-2026-58138

🚨 CVE-2026-58138 — Unauthenticated Remote Code Execution 🔥 Critical Unauthenticated Remote Code Execution in Conductor Affected versions:3.21.21 → 3.30.2 📌 Overview CVE-2026-58138 is a critical unauthenticated Remote Code Execution RCE...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor Unauthenticated RCE via INLINE GraalVM Evaluator Conductor OSS / Orkes3.21.21 … before 3.30.2 evaluates user-supplied JavaScript in INLINE and LAMBDA / DOWHILE / SWITCH tasks with a GraalVM context built with full host access HostAccess.ALL. The script reflects up to...

CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB JAVASCRIPT Trigger-Script RCE post-auth Post-authentication remote code execution in ArcadeDB a Java multi-model database via a JAVASCRIPT trigger that reaches host classes. A trigger's GraalVM polyglot engine is built with a host-class allow-list that includes java.lang...

CVE-2026-58138

CVE-2026-58138 — Conductor Unauthenticated RCE via GraalVM Evaluator -critical TL;DR: Orkes/OSS Conductor versions 3.21.21 to 3.30.2 evaluates user-supplied JavaScript in INLINE tasks using a GraalVM context with full host access HostAccess.ALL. Because the community API has no authentication by...

btr

Branch Target Reuse BTR Artifacts This repository contains the artifacts for the paper "Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries" accepted at ACM CCS 2026. For more information about the BTR attack, see our project-page and our paper! bt...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

openjdk: Enhance HTTP server (Oracle CPU 2026-10)

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

openjdk: Enhance HTTP server (Oracle CPU 2026-10)

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

openjdk: Enhance HTTP server (Oracle CPU 2026-10)

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...

openjdk: Enhance HTTP server (Oracle CPU 2026-10)

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

openjdk: Enhance HTTP server (Oracle CPU 2026-10)

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

openjdk: Enhance HTTP server (Oracle CPU 2026-10)

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...