CVE-2026-34048

CVE-2026-34048 Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute commands on team servers. Intro I found this issue while reviewing Coolify , an open-source self-hosted PaaS, with a very direct...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

copy-fail-mcp

Copy Fail MCP 📖 Installation Guide — quick start, manual setup, and troubleshooting CVE-2026-31431 — The worst Linux vulnerability ever discovered. Now controllable via MCP. 732 bytes of Python. No compilation. No race condition. No per-distro offsets. One shot, universal root on every Linux kern...

CVE-2026-51385

CVE-2026-51385 Advisory for CVE-2026-51385. Needed to publish it as GRAPHIFY hasnt recognized the advisory neither publish it, and MITRE assigned CVE-2026-51385, this is the advisory for it. ES: Este fue mi primer cve, para ser honesto encontre una manera de romper la logica en la funcion ANTI...

keycloak__keycloak_CVE-2014-3656_1-0-5-Final

Open Source Identity and Access Management Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more. Help...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injection Unauthenticated JSON/NoSQL operator injection in Budibase. Any anonymous visitor of a published Budibase app that exposes a PUBLIC query backed by a document datasource MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST wi...

CVE-2024-51482

CVE-2024-51482 - ZoneMinder Blind SQL Injection Table of Contents Overview Vulnerability Details Technical Analysis Exploitation Guide Installation Usage Examples Mitigation References Overview CVE-2024-51482 is a critical boolean-based SQL Injection vulnerability discovered in ZoneMinder, a...

CVE-2026-43866

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproducer CVE-2026-43866 This project demonstrates CVE-2026-43866 , a bypass of the CVE-2026-40860 fix in Apache Camel's camel-jms and camel-sjms / JMS-family components. CVE-2026-40860 added a post-deserialization class allow-list...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

bugbounty-lab101

██████╗ ███████╗██╗ ██╗ ██╗ ██████╗ ██╗██╗ ██╗ ██╔══██╗██╔════╝██║ ██║███║██╔═████╗███║╚██╗██╔╝ ██║ ██║█████╗ ██║ ██║╚██║██║██╔██║╚██║ ╚███╔╝ ██║ ██║██╔══╝ ╚██╗ ██╔╝ ██║████╔╝██║ ██║ ██╔██╗ ██████╔╝███████╗ ╚████╔╝ ██║╚██████╔╝ ██║██╔╝ ██╗ ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═╝╚═╝ ╚═╝ BUG BOUNTY...

CVE-2026-6307

CVE-2026-6307: V8 JS-to-Wasm type confusion → RCE on Chrome 146 Local reproduction and weaponization of the V8 JS-to-Wasm deoptimization type confusion described by Nebula, taken to a xcalc popped from the renderer of Chrome for Testing 146.0.7680.165 the bug is fixed in 147.0.7727.101. All...

Important: Red Hat Security Advisory: Red Hat build of Kueue 1.4.3 release

Red Hat build of Kueue 1.4.3 release The Red Hat build of Kueue is an optional operator, based on Kueue upstream, to enable the installation of Kueue on Openshift. Kueue is a queueing framework for managing Kubernetes workloads. This release is based on Kueue v0.18.11...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — AXIS mediaclip.cgi OS Command Injection n-day research writeup & PoC — post-patch technical analysis of a CVSS 7.1 OS command injection vulnerability in the AXIS VAPIX Media Clip API, independently rediscovered and verified through black-box testing against an Axis device. Axis's...

mcpjam-cve-2026-23744-validator

MCPJam Inspector Authorized Security Validator A bounded proof-of-concept validator for CVE-2026-23744 affecting vulnerable MCPJam Inspector deployments. This project is an independent, non-destructive validation tool for the previously disclosed CVE-2026-23744. It is not the original vulnerabili...

Open-Source-Threat-Intel-Feeds

Free Threat Intel/IOC Feeds This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the Vendor, Description, Category and URL. The vendors offering ThreatIntelFeeds a...

Malicious code in eth-address-utils (RubyGems)

Source: amazon-inspector 8ed9d372d4fc694697be41c22e7c4d02d873e53e16bde2336069787b7b961ce2 The gem advertises itself as an Ethereum address utility library but its extconf.rb auto-executed by gem install carries a base64-encoded payload that is decoded and passed to eval inside a double-forked,...