CVE-2026-14814

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

CVE-2026-14814 Permissive Regular Expression in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

EUVD-2026-98177

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input...

CVE-2026-93886

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input...

PT-2026-111167

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

CVE-2026-19622

IBM Planning Analytics Local versions 2.0 and 2.1 are affected by a vulnerability where a remote attacker could bypass authentication and escalate privileges due to improper validation of sub-requests. This issue is associated with CWE-288 . The vulnerability has been addressed in IBM Planning An...

CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

CVE-2026-19627

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to a security flaw caused by improper validation of file paths . This allows a remote attacker to read arbitrary host files and overwrite certain application files . The vulnerability is associated with CWE-22 (Path Traversal). No specifi...

day01-sessionreaper-lab

Day 1 — SessionReaper-style Vulnerable Lab Educational This is a tiny lab that simulates the core idea reported for CVE-2025-54236 “SessionReaper”: improper validation of nested JSON leading to dangerous code paths. This is not Magento/Adobe Commerce; it's a minimal educational replica to practic...

K000163668: Go vulnerability CVE-2024-9341

Security Advisory Description A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system int...

CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed regist...

CVE-2026-105280

The hexpm hex package (versions 0.20.2 before 2.5.2 ) is vulnerable to an Improper Validation of Integrity Check Value (CWE-354). When using mix hex.package fetch PACKAGE VERSION --output -, the tool writes bytes from Hex.SCM.fetch/3 directly to standard output without performing the required che...

EEF-CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

Summary Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signe...

CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed regist...

CVE-2026-93693

Progress ShareFile Storage Zones Controller versions v5.12.6 and below are vulnerable to a vulnerability chain involving improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on the queue service. A remote unauthenticate...

CVE-2026-107429

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107429

The WordPress Paid Videochat Turnkey Site (ppv-live-webcams) plugin is vulnerable to an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) in versions up to and including 7.5.12 . This flaw allows for Input Data Manipulation . While the specific component or function is n...

CVE-2026-107429 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-106605

The WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce plugin is vulnerable to an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) in versions n/a through 2.3.22 . This flaw allows for Input Data Manipulation . No specific root cause details, remed...

CVE-2021-24762

Overview This repository documents the detection of CVE-2021-24762, a vulnerability identified on a WordPress instance through HTTP scanning. The vulnerability was discovered on the WordPress AJAX endpoint: /wp-admin/admin-ajax.php This endpoint is commonly used by WordPress plugins and themes to...