CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

CVE-2026-82864

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method. An attacker can supply a crafted PDF with a FlateDecode stream containing a decompression bomb, causing a small compressed file to decompress to hundreds of megabytes. ...

CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

EUVD-2026-68399

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865

pdfme schemas versions prior to 5.5.10 are affected by a cross-site scripting (XSS) vulnerability in the multiVariableText property panel . The root cause is the assignment of unsanitized i18n label values to innerHTML , allowing an attacker who controls label overrides via options.labels to inje...

probo

Probo 엔지니어를 위한 오픈소스 GRC 플랫폼. Probo는 엔지니어링 및 보안 팀을 위해 구축된 자체 호스팅 가능한 거버넌스, 리스크, 컴플라이언스GRC 플랫폼입니다. 전체 GRC 수명 주기를 다룹니다: 위험 식별, 통제 추적, 공급업체 리스크, 데이터 프라이버시, 접근 검토, 감사 프로그램, 문서 승인 워크플로우. 모든 엔티티는 웹 콘솔, CLI, Model Context Protocol MCP API, GraphQL API를 통해 접근할 수 있어 코드, 스크립트 또는 모든 LLM 에이전트에서 컴플라이언스 작업을 자동화...

BIT-TOMCAT-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0...

CVE-2026-72818

A flaw was found in NLTK. The TweetTokenizer component, used for processing social media text, contains a regular expression vulnerability. A remote unauthenticated attacker can provide specially crafted input containing many alternating label separators, causing the regular expression to backtra...

K000163143: Multiple CoreDNS vulnerabilities CVE-2026-35579, CVE-2026-33489, CVE-2026-33190, CVE-2026-32934, CVE-2026-32936

Security Advisory Description CVE-2026-35579 CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configurati...

CVE-2026-33017-langflow-rce

CVE-2026-33017 — Langflow 인증되지 않은 원격 코드 실행 RCE 개요 CVE ID: CVE-2026-33017 영향받는 소프트웨어: Langflow 취약한 버전: = 1.9.0 심각도: 치명적 작성자: r3nsi15 날짜: 2026 설명 Langflow는 공개 플로우 빌드 엔드포인트/api/v1/buildpublictmp/flowID/flow를 노출하며, 인증 없이 임의의 CustomComponent 코드 블록을 수락하고 서버 측에서 실행합니다. 악의적인 Python 페이로드를 CustomComponent...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

Laravel-Security

Laravel Security Laravel Security は Graham Campbell によって作成され、現在もメンテナンスされています。voku/anti-xss を Laravel 用にラップしたもので、graham-campbell/security-core を使用しています。変更ログ、リリース、セキュリティポリシー、ライセンス、行動規範、コントリビューションガイドライン をぜひご確認ください。 インストール このバージョンには PHP 8.0〜8.3 が必要で、Laravel 9〜11 をサポートしています。 最新バージョンを入手するには、Composer...

HTB-Reactor-Linux-Machine-Walkthrough

HTB: Reactor !CAUTION 스포일러 경고. 이 문서는 플래그를 포함한 전체 풀이 과정입니다. 직접 머신을 풀고 싶다면 지금 이 문서를 닫고, 막힐 때 다시 오세요. Machine Info 필드| 세부 정보 ---|--- 이름| Reactor OS| Ubuntu 24.04 LTS Noble 난이도| 중간 CVE| CVE-2025-55182 CVSS 10.0 포트| 22 SSH, 3000 Next.js 작성자| sonnycroco 개요 Reactor는 ReactorWatch 라는 원자력 발전소 모니터링 대시보드를 주제...

CVE-2021-28378

CVE-2021-28378 이 CVE에 대한 자세한 내용은 여기에서 확인할 수 있습니다. 이 CVE는 서버에서 가져온 콘텐츠의 클라이언트 측에서 문자열 이스케이프가 누락된 것을 대상으로 합니다. 공격자가 이슈나 풀 리퀘스트에 댓글을 작성하여 쉽게 임의 코드를 주입할 수 있게 합니다. 이는 2020년 1월 말에 커밋 7d7ab1eeae43d99fe329878ac9c8db5e45e2dee5에서 도입되었지만, 스쿼시squash 때문에 정확히 누가 이 취약점을 도입했는지와 유사한 버그가 도입되었는지 조사할 수 없습니다. 먼저, 이...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses httpclient5-5.6.2.jar, aiohttp-3.13.4-cp311-cp311-manylinux2014x8664.manylinux217x8664.manylinux228x8664.whl, ip-address-10.2.0.tgz, datasets-3.6.0-py3-none-any.whl, jackson-databind-2.21.4.jar, keras-3.13.2-py3-none-any.whl, log4j-api-2.24.3.jar,...

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-34207

CVE-2026-34207 SSRF过滤器检查了主机名字符串，但实际目的地是由后续的DNS决定的。这一漏洞使得攻击者控制的Webhook URL能够到达回环地址、元数据服务和私有网络目标。 介绍 我在审查Typebot （一个开源聊天机器人构建器）时发现了这个漏洞，心中带着一个简单的安全问题： 如果SSRF保护验证的是主机名字符串，而实际目的地是由后续的DNS决定的，会发生什么？ 在这个案例中，这个问题引出了一个真正的漏洞。 Typebot 的 Webhook / HTTP 请求块的 SSRF 保护仅验证了： URL 字符串， 封禁了主机名字面量， 以及字面量 IP 格式 它没有...

tcpreplay v4.6.1

Tcpreplay Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Windows under Cygwin for editing and replaying network traffic previously captured by tools like tcpdump and Wireshark. It classifies traffic as client or server, rewrites Layer 2/3/4 headers, and replays it back onto the...