125265 matches found
CVE-2026-20717
CVE-2026-20717 describes improper input validation in some Intel QAT software drivers for Windows prior to version 1.13, exploitable in Ring 3 (local). An authenticated, low-privilege user could cause a denial of service with a low=confidentiality and integrity impact and a high availability impa...
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Summary The dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM an untrusted principal per the project's own threat model can set it to true in any tooluse response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injecte...
GHSA-M77W-P5JJ-XMHG OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Summary The dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM an untrusted principal per the project's own threat model can set it to true in any tooluse response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injecte...
jq: jq: Denial of Service via crafted JSON object causing hash collisions
A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause has...
Exploit for CVE-2026-29000
🚀 CVE-2026-29000 - pac4j-jwt Authentication Bypass Exploit !...
Security Bulletin: Vulnerabilities in IBM Semeru Runtime affect Host on Demand.
Summary There are vulnerabilities in IBM Semeru Runtime used by Host on Demand. Host on Demand has provided fixes for the applicable CVEs. Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component could allow a remote...
GHSA-2G4X-FQ3J-CGQ4 Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
Summary ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes closeresults at line 438, but the second stage — which processes POST-body parameters dp — ...
Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
Summary ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes closeresults at line 438, but the second stage — which processes POST-body parameters dp — ...
K000161227: PHP vulnerability CVE-2016-4473
Security Advisory Description /ext/phar/pharobject.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833. CVE-2016-4473 Impact There is no impact; F5 products are not affected by this vulnerability. Security...
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option
Summary When dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine's logging path. The logger opens the...
GHSA-8HF9-3Q64-Q2QF Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option
Summary When dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine's logging path. The logger opens the...
GHSA-35WR-X7V6-9FV2 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`
Summary When dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to...
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`
Summary When dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to...
Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`
GHSA: Unauthenticated Remote Code Execution via found-action in Dalfox Server Mode Summary When dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options —...
GHSA-V25V-M36W-JP4H Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`
GHSA: Unauthenticated Remote Code Execution via found-action in Dalfox Server Mode Summary When dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options —...
May 12, 2026-Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 (KB5087048)
May 12, 2026-Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 KB5087048 Applies to: Microsoft .NET Framework 3.5 Important The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows...
May 12, 2026-Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012 R2 (KB5087069)
May 12, 2026-Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012 R2 KB5087069 Applies to: Microsoft .NET Framework 4.8 Important The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Window...
May 12, 2026-Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012 (KB5087067)
May 12, 2026-Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012 KB5087067 Applies to: Microsoft .NET Framework 4.8 Important The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows...
May 12, 2026-KB5087066 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1809 and Windows Server 2019
May 12, 2026-KB5087066 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1809 and Windows Server 2019 Release Date: May 12, 2026 Version: .NET Framework 3.5 and 4.8 The May 12, 2026 update for Windows 10, version 1809 and Windows Server 2019 includes security and cumulative...
May 12, 2026-KB5087068 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows Server 2022
May 12, 2026-KB5087068 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows Server 2022 Release Date: May 12, 2026 Version: .NET Framework 3.5 and 4.8 The May 12, 2026 update for Windows Server 2022 includes security and cumulative reliability improvements in .NET Framework 3.5 and 4.8. W...