EUVD-2026-67224

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2023-27372-PoC

Questa è una proof of concept della vulnerabilità RCE CVE-2023-27372 in SPIP. È un difetto di deserializzazione che sfrutta l'uso pericoloso del tag ENV durante la funzionalità di reset della password spip.php?page=spippass all'interno di /ecrire/balise/formulaire.php. Nello specifico questa riga...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses ip-address-9.0.5.tgz, postcss-8.4.38.tgz, postcss-8.4.48.tgz, postcss-8.5.6.tgz, requests-2.32.4-py3-none-any.whl, requests-2.32.5-py3-none-any.whl which are vulnerable to CVE-2026-42338, CVE-2026-41305, CVE-2026-25645. This bulletin...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses dompurify-3.4.8.tgz which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses dompurify-3.4.8.tgz which is vulnerable to CVE-2026-65898, CVE-2026-65899. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in DOMPurify

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses js-yaml-4.1.1.tgz, tar-7.5.15.tgz, ujson-5.12.1-cp311-cp311-manylinux224x8664.manylinux228x8664.whl, decode-uri-component-0.2.2.tgz and body-parser-1.20.5.tgz which are vulnerable to CVE-2026-53550, CVE-2026-53655, CVE-2026-54911, CVE-2026-45822 and CVE-2026-12590...

Security Bulletin: XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36431)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability. Vulnerability Details CVEID:CVE-2025-36431 DESCRIPTION: IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site...

SwaggerUI-CVE-2018-25031

Exploit Swagger UI - CVE-2018-25031 Exploit Swagger UI - Travisamento dell'Interfaccia Utente UI di Informazioni Critiche CVE-2018-25031. Questo exploit verifica se la Swagger UI utilizzata è suscettibile allo sfruttamento della vulnerabilità di Travisamento dell'Interfaccia Utente UI di...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub had vulnerabilties which were resolved. - fastapi, follow-redirects, dompurify, bn.js, elliptic, form-data, js-yaml, poetry, golang.org/x/text, transformers, qs, langchain, brace-expansion, echarts, golang.org/x/sys,...

SPIPScan

SPIPScan Scanner SPIP CMS per scopi di penetration testing scritto in Python e rilasciato sotto licenza MIT. Questo strumento è stato progettato per eseguire il rilevamento delle installazioni SPIP durante il penetration testing. Attualmente, lo strumento rileva la versione dell'installazione SPI...

NINJA-PingU

NINJA PingU NINJA-PingU Is Not Just a Ping Utility è uno strumento di scansione di rete open source, gratuito e ad alte prestazioni, pensato per analisi su larga scala. È stato progettato con le prestazioni come obiettivo principale e sviluppato come framework per consentire una facile creazione ...

CVE-2019-2618

PoC root@kitploit: POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux i686; rv:20.0 Gecko/20100101 Firefox/20.0 Accept: text/html, image/gif, image/jpeg, /; q=.2 Connection: keep-alive username: weblogic password: weblogic...

CVE-2026-59316 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

EUVD-2026-67198

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316

CVE-2026-59316 is a stored XSS vulnerability in Spring Authorization Server 's DefaultConsentPage . User-controlled values from an OAuth2 authorization request are rendered without HTML entity encoding, allowing an attacker to inject malicious scripts that execute when the consent page is present...

CVE-2026-59316 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

optee-qemu

CVE-2021-44733: Fuzzing e sfruttamento di una use-after-free nel sottosistema TEE del kernel Linux Recentemente è stata scoperta una vulnerabilità use-after-free nel sottosistema TEE del kernel Linux, fino alla versione 5.15.11 inclusa, alla quale è stato assegnato l'ID CVE-2021-44733 1. A prima...

EUVD-2026-67177

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...