CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

DEBIAN-CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

AZL-105245 CVE-2026-101902 affecting package python-tensorboard 2.16.2-6

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

UBUNTU-CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

CVE-2026-101902 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

The Axios promise-based HTTP client (versions 0.27.2 until 0.34.0 and 1.20.0) contains a read-side prototype pollution gadget within its request dispatch logic. The vulnerability allows an attacker who has achieved prototype pollution elsewhere in the process to manipulate Object.prototype.method...

CVE-2026-101902 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

gitlab-cve-2026-19478-lab

CVE-2026-19478 — GitLab GraphQL @glintroduced 未认证任意方法调用（验证实验室 + PoC） 针对 CVE-2026-19478 （GitLab CE/EE，CVSS 9.4，严重）的可复现 A/B 实验室与安全 PoC。 未认证的攻击者可以对 GraphQL 解析出的领域对象调用任意零参数 Ruby 方法 — 例如调用 Projectdestroy 来在无凭证的情况下删除公共项目 。 还附带随同一版本修复的姊妹漏洞 CVE-2026-19650 （GraphQL multiplex 查询交换）的 PoC。 仅限授权的安全测试 /...

CVE-2017-12615

CVE-2017-12615 Usage: CVE-2017-12615.py http://targetip:port When ops retardedly enable put method in web.xml on Apache Tomcat 7.0.0 - 7.0.79 this EXP should be working...

NPM: scim-patch: Mutation of Inherited Built-in Method Objects

NPM: scim-patch: Mutation of Inherited Built-in Method Objects vulnerability discovered by ? in WordPress Npm scim-patch versions 0.9.2...

Anti-Tamper-Perturbation

🛡️ 無許可の個人画像生成に対する改ざん防止保護 ICCV 2025 論文の公式コード 📄 無許可の個人画像生成に対する改ざん防止保護 ⚙️ 環境構築 conda create --name ATP --file requirements.txt conda activate ATP 🔐 ATPの起動 1. データセット CelebA-HQ と VGGFace2 をダウンロードします。データセットへのリンクは CelebA-HQ、VGGFace2 から入手できます。認証モデルのトレーニングには、FFHQ もダウンロードする必要があります。 2. 認証モデルの重み とガイド用の マスク...

Apache-Superset-Remote-Code-Execution-PoC-CVE-2018-8021

Apache Superset の pickle ライブラリのコード実行 IBM : Apache Superset は、pickle ライブラリの安全でない load メソッドを使用してデータをデシリアライズするため、リモートの攻撃者がシステム上で任意のコードを実行可能にする可能性があります。特別に細工されたリクエストを送信することで、攻撃者はこの脆弱性を悪用してシステム上で任意のコードを実行できます。 参考文献 : https://github.com/apache/incubator-superset/pull/4243...

CVE-2020-11651

CVE-2020-11651 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user...

CVE-2025-59528-PoC

CVE-2025-59528 PoC PythonのPoCスクリプト。POST /api/v1/node-load-method/customMCP 経由でFlowiseの CustomMCP RCEパスをトリガーします。 ⚠️ 教育目的および許可されたセキュリティ研究のみに使用してください。 このツールを、自分が所有していないシステムや、テストのための書面による許可がないシステムに対して実行することは違法です。 クレジット im-soohyun Kim SooHyun 詳細 CVE-2025-59528 の PoC 影響を受けるバージョン: Flowise 3.0.5 修正バージョン:...

CVE-2026-94284

A flaw was found in libX11. An out-of-bounds read vulnerability exists in the X Input Method XIM trigger-key registration parser. A malicious X server can exploit this flaw by sending specially crafted trigger-key registration data to connected client applications, causing them to crash and...