atproto

Blacksky AppView Voici le fork de Blacksky de l'implémentation de référence du protocole AT par Bluesky Social PBC. Il alimente l’AppView à l’adresse api.blacksky.community. Nous publions ce code par souci de transparence et pour que d’autres communautés puissent bénéficier de ce travail. Ce dépô...

gortex-PoC

Следование по символическим ссылкам при обходе файлов индексатором → Раскрытие содержимого за пределами репозитория через searchtext Статус CVE: запрошен, ожидает присвоения. Данная находка опубликована как GHSA-6vhf-4wcm-2r83. При присвоении CVE данный репозиторий будет переименован в...

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Component: Elasticsearch indexer indexer/ Primary location: indexer/common.go:2395-2407 serializedDataForUpdateAccounts Entry point: SetAccountName native transaction contract type 12 — core/process/transaction/txProcess.go:688 --- Description When the node indexes account updates to Elasticsearc...

GHSA-7C7C-373R-GFJJ Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Component: Elasticsearch indexer indexer/ Primary location: indexer/common.go:2395-2407 serializedDataForUpdateAccounts Entry point: SetAccountName native transaction contract type 12 — core/process/transaction/txProcess.go:688 --- Description When the node indexes account updates to Elasticsearc...

CVE-2026-82409

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

CVE-2026-82409 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

EUVD-2026-85647

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

CVE-2026-82409

Prior to version 1.7.20 , the Klever-Go blockchain implementation is vulnerable to Elasticsearch bulk / painless injection due to improper escaping of the acc.Name value in indexer/common.go. Because the SetAccountName transaction accepts raw UTF-8 characters including quotes, backslashes, and ne...

CVE-2026-82409 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

PT-2026-97539

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description An issue exists in the Elasticsearch indexer component where the serializedDataForUpdateAccounts function in indexer/common.go fails to escape the acc.Name variable when constructing bulk JSON and...

CVE-2026-82409: Improper Encoding or Escaping of Output

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

PT-2026-95049

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote ' could break out of the literal...

FreeBSD : Gitea -- multiple vulnerabilities (fac18f5f-afc2-11f1-8266-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fac18f5f-afc2-11f1-8266-3c7c3fba4204 advisory. Gitea reports: This release contains fixes for 26 security issues, hardens issue searching tha...

CVE-2026-85084 Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers...

CVE-2026-56095

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-56092

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

CVE-2026-56092

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-56095

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

PT-2026-81224

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The indexer of the extension uses the PHP unserialize function to process field values returned by content object rendering when transferring multi-value data fo...