dubbo-CVE-2023-23638

CVE-2023-23638 For educational purposes only ZooKeeper required Tested on Java 8. Other versions have not been tested and are not guaranteed to work. To reproduce, add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For details, see...

Exploit for CVE-2026-106445

CVE-2026-106445 — Handlebars.js RCE constructor own-property...

CVE-2026-54517

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer.deserializeUsingPropertyBased, the active-view @JsonView filter was applied only to creator properties; the regular...

EUVD-2026-20600

LiquidJS: ownPropertyOnly bypass via sortnatural filter — prototype property information disclosure through sorting side-channel...

PT-2026-31351

Summary The sort natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary e.g., multi-tenant template syste...