3583 matches found
CVE-2026-101363
Vulnerability in Oracle REST Data Services component: Graph QL. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability c...
CVE-2026-91609
A vulnerability exists in the Oracle REST Data Services (component: Graph QL ) affecting supported versions 24.2.0-26.2.1 . This easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the service. Successful exploitation can lead to unauthorized access...
CVE-2026-101363
A vulnerability exists in the Graph QL component of Oracle REST Data Services affecting supported versions 24.2.0-26.1.0 . An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the service, potentially resulting in unauthorized read access to a subset of acc...
CVE-2016-20102
JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only...
EUVD-2016-10919
JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only...
CVE-2016-20102
JavaMelody versions prior to 1.60.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious scripts by providing crafted values in the graph parameter of the /monitoring?part=graph endpoint. The root cause is that the graph value is...
CVE-2016-20102 JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter
JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only...
DOGE
DOGE Darknet Osint Graph Explorer Still in dev, works right. You should use this in addtion to Darknet OSINT Transform Pay attention here Query prototype: SELECT DISTINCT customcolumnname AS input, anothercustomname AS output FROM sometable, obviously you can add other options as WHERE, ORDER BY,...
CVE-2026-78165
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...
EUVD-2026-104221
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...
aegisgraph
AegisGraph — Engineering Platform Graph-driven automated vulnerability discovery for secure messaging applications. 577 Industries' engineering implementation for DARPA SBIR Direct-to-Phase-II topic HR0011SB20254-12 ASEMA. -blue Looking for evaluator-facing artifacts? The sanitized public...
CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars
Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...
CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars
Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...
CVE-2026-97859
The Gitea platform contains a vulnerability where seven API routes under /api/v1/users/{username} (including followers, following, starred, subscriptions, and keys) were registered without the individualPermsChecker middleware. This oversight allows an authenticated user to access the social grap...
CVE-2026-98613 bpf: Bound ownership depth through local kptrs and graph roots
In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...
CVE-2026-98613
The Linux kernel contains a vulnerability where program-allocated objects can own other local objects via referenced kptrs . The bpf_obj_free_fields() function follows these pointers synchronously through __bpf_obj_drop_impl() before RCU-based freeing. This allows self-referential local kptr type...
CVE-2026-98613 bpf: Bound ownership depth through local kptrs and graph roots
In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...
CVE-2026-98613
In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 M365 credential belonging to ConnectWise Cloud Backup formerly SkyKick to gain unauthorized access to customers' M365 environments. ConnectWise Clo...