CVE-2026-104908

MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off. However, the application stripped...

EUVD-2026-91745

MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off. However, the application stripped...

CVE-2026-104908

MISP versions prior to 2.5.48 are vulnerable to an improper input validation vulnerability in the decaying model import functionality. The application fails to adequately sanitize nested model keys during the import process, as it only strips top-level id and uuid fields while pinning org_id and ...

EXPLOIT-CVE-2026-22778

CVE-2026-22778 — RCE en vLLM en el procesamiento de vídeo Laboratorio vulnerable + prueba de concepto para CVE-2026-22778 CVSS 9.8, una cadena de ejecución remota de código no autenticada en la ruta de ingesta multimodal de vLLM. | ---|--- CVE| CVE-2026-22778 Aviso| GHSA-4r2x-xpjr-7cvv Afectado|...

CVE-2026-5782

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not...

cve-2025-22457

CVE-2025-22457 模拟：基于栈的缓冲区溢出分析 本项目涉及因嵌入式系统（固件）输入验证缺失（使用 strcpy）而导致的基于栈的缓冲区溢出漏洞的实验室环境模拟、逆向工程分析及利用。 🛠️ 依赖要求 要在本地环境中运行此模拟，必须安装以下工具： Kali Linux（或类似的基于 Debian 的发行版） gcc（编译器） gdb（GNU 调试器 - 用于动态分析） python3（用于漏洞利用脚本） ⚙️ 安装与编译 为了在实验室环境中观察漏洞而不受现代操作系统保护机制（栈金丝雀、NX、PIE）的干扰，编译时需要禁用内存保护。 打开终端，使用以下命令编译源代码： gcc...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 概念验证 CVE-2025-27515 的实用演示，这是一个 Laravel 框架（≤ 12.0.0）中的文件上传验证绕过漏洞。 漏洞概述 CVE-2025-27515 是一个验证绕过漏洞，当 Laravel 应用程序使用通配符验证模式（files.）时，攻击者可以规避文件上传限制。该漏洞通过利用 Laravel 处理基于数组的文件上传时的缺陷，允许上传恶意文件。 严重性： 中/高 CWE: CWE-20（输入验证不当） 攻击向量 该利用使用 多语言 JPEG+PHP 文件 ，该文件： 包含有效的 JPEG 幻数（FF D8 FF E0）以绕过 MIME...

PoC-CVE-2025-69421

CVE-2025-69421 仅崩溃复现器 本仓库包含一个最小的畸形 PKCS12 文件，可在隔离的实验室环境中复现 CVE-2025-69421。 生成的 PFX 包含 EncryptedData，其 EncryptedContentInfo 省略了可选的 encryptedContent 字段。易受影响的 OpenSSL 版本可能会将 NULL ASN1OCTETSTRING 指针从 PKCS12unpackp7encdata 传递给 PKCS12itemdecryptd2iex，而后者在未进行 NULL 检查的情况下解引用该指针。...

CVE-2020-12641

CVE-2020-12641: 通过Roundcube Webmail中的“imconvertpath”参数进行命令注入 Roundcube 1.4.4、1.3.11和1.2.10之前的版本存在一个命令注入漏洞。 由于"imconvertpath"没有执行清理/输入过滤，能够访问Roundcube安装程序的攻击者可以在此参数中注入系统命令，当任何用户打开包含"非标准"图像的电子邮件时，这些命令将会执行。 供应商披露： 此漏洞的供应商披露和修复可以在此处找到。 要求： 此漏洞需要： 访问Roundcube Webmail安装程序组件 等待Roundcube用户打开包含非标准图像的电子邮件...

fuzz.txt

fuzz.txt No hay nada tan permanente como lo temporal ¿Alguna idea?...

EUVD-2026-91563

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

EUVD-2026-91560

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-94636

The Apache Thrift py bindings are vulnerable to improper handling of highly compressed data (data amplification), function calls with incorrectly specified arguments, and improper validation of specified quantities in input. Specifically, the Python TZlibTransport stops enforcing its decompressed...

CVE-2026-85494

A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger...

CVE-2026-91777

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

CVE-2021-35042

CVE-2021-35042: Django SQL注入漏洞 I. 概述 Django是一个用Python编写的开源Web应用框架，基于MVC（模型-视图-控制器）模式构建。最初它是为了管理Lawrence出版集团旗下的新闻内容网站而构建的，是一个内容管理系统（CMS）软件。 Django 3.1.x至3.1.13版本以及3.2.x至3.2.5版本存在SQL注入漏洞。 导致该漏洞的原因是QuerySet.orderby中对用户控制的输入数据的过滤功能不足以防御SQL注入攻击。此漏洞可被利用，允许攻击者执行未经授权的操作，从而导致敏感数据泄露。 CVE - ID| CVE-2021-350...

API-Security-Checklist

English | 繁中版 | 简中版 | العربية | Azərbaycan | Български | বাংলা | Català | Čeština | Deutsch | Ελληνικά | فارسی | Français | हिंदी | Indonesia | Italiano | 日本語 | 한국어 | ພາສາລາວ | Македонски | മലയാളം | Монгол | Nederlands | Polski | Português Brasil | Русский | ไทย | Türkçe | Українська | Tiếng Việt...

CVE-2026-97641

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-97336

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-102772

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...