Cisco ASA Reachable Assertion (CVE-2021-1422)

A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the...

PT-2026-107246

Name of the Vulnerable Software and Affected Versions @backstage/plugin-auth-backend-module-cloudflare-access-provider versions 0.1.0 through 0.4.9 Description Insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for a different Access applicati...

PT-2026-107247

Name of the Vulnerable Software and Affected Versions @backstage/plugin-catalog-backend-module-bitbucket-server versions 0.4.0 through 0.5.14 Description Inconsistent repository filtering occurs during Bitbucket Server catalog event updates. Deployments utilizing event-driven updates may ingest...

EUVD-2026-78300

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...

CVE-2026-105782 Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object,...

CVE-2026-105782

The Scrapy web crawling framework (versions 1.4.0 through 2.14.1) is vulnerable to arbitrary module import via the Referrer-Policy response header. The RefererMiddleware in scrapy/spidermiddlewares/referer.py incorrectly treats values resembling Python import paths as referrer policy classes, imp...

CVE-2026-105782 Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object,...

CVE-2026-105782 Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object,...

Tinypool: Prototype Pollution Gadget to RCE in run() options

tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...

CVE-2026-105438

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-38751-OpenSTAManager-Arbitrary-File-Upload-PoC

CVE-2026-38751 – OpenSTAManager मनमाना फ़ाइल अपलोड PoC इस रिपॉज़िटरी में CVE-2026-38751 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट PoC एक्सप्लॉइट शामिल है, जो OpenSTAManager ≤ 2.10 को प्रभावित करता है। यह कमज़ोरी एक प्रमाणित हमलावर को मॉड्यूल अपडेट कार्यक्षमता के माध्यम से एक दुर्भावनापूर्ण मॉड्यूल अपलोड करने ...

CVE-2021-27877-PoC

CVE-2021-27877 प्रूफ ऑफ कॉन्सेप्ट इस रिपॉजिटरी में Veritas Backup Exec Agent को प्रभावित करने वाले CVE-2021-27877 के लिए मूल Rapid7 Metasploit मॉड्यूल का एक संशोधित संस्करण शामिल है। मेरे परीक्षण के दौरान, मूल Metasploit मॉड्यूल ने लक्ष्य को सफलतापूर्वक कमजोर के रूप में पहचान लिया, लेकिन पेलोड...

EUVD-2026-92798

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438

A Server-Side Request Forgery (SSRF) vulnerability exists in O2OA versions up to 10.0.1-ce . The flaw is located in the General Module within the function ActionUploadExcelWithUrl at the file path /x_general_assemble_control/jaxrs/excel/upload/with/url. An attacker can achieve SSRF by manipulatin...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

NGINX-Rift

NGINX Rift — CVE-2026-42945 / CVE-2026-9256 भेद्यता स्कैनिंग और सत्यापन उपकरण NGINX Rift CVE-2026-42945 और CVE-2026-9256 NGINX ngxhttprewritemodule हीप ओवरफ़्लो भेद्यता के लिए एक ओपन-सोर्स स्कैनिंग और सत्यापन उपकरण है। यह रिमोट नेटवर्क फ़िंगरप्रिंट स्कैनिंग और स्थानीय गहन कॉन्फ़िगरेशन ऑडिट का...

CVE-2026-27654

CVE-2026-27654 NGINX ngxhttpdavmodule में sizet अंडरफ़्लो के माध्यम से हीप बफ़र ओवरफ़्लो रिमोट DoS / संभावित RCE विवरण src/http/modules/ngxhttpdavmodule.c में ngxhttpdavcopymovehandler Destination हेडर के URI पथ घटक से लोकेशन प्रीफ़िक्स लंबाई घटाकर गंतव्य URI लंबाई की गणना करता है। दोनों मान size...

CVE-2026-90194

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI scan module. When a device fails to add, the system's rollback process does not properly clean up allocated bus IDs and instance numbers. This oversight can lead to a resource leak, potentially causing a Denial...