CVE-2026-82727

ash_phoenix (by ash-project) has a sensitive information disclosure in AshPhoenix.Form.Auto 's union sub-form handling. When the submitted _union_type parameter does not match a configured type, the raised error message embeds the full raw parameter map via inspect(params, pretty: true). Because ...

cve-2025-4664

CVE-2025-4664 Questo repository contiene un PoC per sfruttare CVE-2025-4664, una vulnerabilità in cui i browser basati su Chromium perdono parametri URL sensibili attraverso richieste di precaricamento dell'intestazione Link. Risorse Per una spiegazione dettagliata di come funziona questo exploit...

GHSA-9JPJ-G8VV-J5MF OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

Summary Before OpenClaw 2026.4.2, the Gemini OAuth flow reused the PKCE verifier as the OAuth state value. Because the provider reflected state back in the redirect URL, the verifier could be exposed alongside the authorization code. Impact Anyone who could capture the redirect URL could learn bo...

CVE-2024-26477

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazonsns, export endpoints...

EUVD-2024-39204

Malicious code in bioql PyPI...

FoosunCMS SQL Injection Vulnerability

FoosunCMS is a content management software based on ASP+ACCESS/MSSQ architecture. FoosunCMS version 1.0 to 2.0 has a SQL injection vulnerability, because the system does not filter the CityId parameter. Allow attackers to exploit the vulnerability to obtain sensitive information in the database...