CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

CVE-2026-78594

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

GHSA-VMG4-6GFG-83QX ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/" with a valid editor session and body of "toString.call":"x", overwriting the global toString function with value x. Fabian...

NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.32.0...

CVE-2026-78594 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

CVE-2026-78594 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

CVE-2026-78594 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

CVE-2026-78594

Elastic APM Server is affected by an Improper Handling of Highly Compressed Data (CWE-409) vulnerability that causes a persistent denial of service . An authenticated user with write access to source map content can store specially crafted, highly compressed data that exhausts APM Server memory u...

WordPress Persistent Login plugin <= 3.1.0 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

PT-2026-84575

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

CVE-2026-84696: Missing Authentication for Critical Function

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

Session fixation vulnerability

Jenkins's "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated vi...

PT-2026-84735

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

yolobox v0.19.4

██╗ ██╗ ██████╗ ██╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ╚██╗ ██╔╝██╔═══██╗██║ ██╔═══██╗██╔══██╗██╔═══██╗╚██╗██╔╝ ╚████╔╝ ██║ ██║██║ ██║ ██║██████╔╝██║ ██║ ╚███╔╝ ╚██╔╝ ██║ ██║██║ ██║ ██║██╔══██╗██║ ██║ ██╔██╗ ██║ ╚██████╔╝███████╗╚██████╔╝██████╔╝╚██████╔╝██╔╝ ██╗ ╚═╝ ╚═════╝ ╚══════╝ ╚═════╝ ╚═════╝...

APM Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-152)

Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map...

CVE-2026-80047

A vulnerability in Hugging Face Transformers versions 4.57.0 to 5.16.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-18752

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-18752 Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...