CVE-2024-27348-HugeGraph-RCE

CVE-2024-27348: Apache HugeGraph RCE Advanced Sandbox Bypass An advanced, highly reliable Proof of Concept PoC exploit for CVE-2024-27348 Remote Code Execution in Apache HugeGraph Server. Unlike many public PoCs that execute commands blindly or fail on complex payloads due to Java's Runtime.exec...

CVE-2026-102094

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cau...

CVE-2026-102094 Kiteworks Email Protection Gateway unsafe reflection

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cau...

CVE-2026-102094 Kiteworks Email Protection Gateway unsafe reflection

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cau...

CVE-2026-102094

The Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection . The vulnerability exists because the mail-processing pipeline fails to sufficiently restrict code loaded from an imported rule configuration . An authenticated administrator with mail-rule configurati...

PT-2026-103532

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description The software is subject to Unsafe Reflection, a condition where an application allows the loading of classes or methods dynamically without sufficient validation. This occu...

CVE-2026-102094: Use of Externally-Controlled Input to Select Classes or Code

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cau...

CVE-2026-93762

A flaw was found in Mongoid. An unsafe reflection vulnerability exists in the query path used for embedded documents, where user-controlled input can trigger unintended internal methods. An unauthenticated remote attacker can exploit this issue by submitting a crafted field name to certain...

CVE-2026-93765

A flaw was found in Mongoid. An unauthenticated remote attacker can exploit an unsafe reflection vulnerability by sending crafted input keys through an application that uses Mongoid for data persistence. This causes the application to execute unintended internal methods instead of performing...

CVE-2025-33073

CVE-2025-33073 — Windows SMB Client NTLM Reflection EoP Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. An improper access control flaw in the Windows SMB Client that revives NTLM reflection techniques thought to be mitigated — letti...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

EUVD-2026-88242

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292

Apache ActiveMQ Artemis versions before 2.34.0 are vulnerable to an unsafe reflection vulnerability within the FederationStreamConnectMessage.getFederationPolicy() method. The root cause is the direct reading of a class name from the CORE protocol wire buffer without proper type validation, which...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-95832

A flaw was found in kitty. This vulnerability allows an application writing output to the terminal to execute arbitrary commands in the user's shell. The issue occurs because the color control escape code handler echoes unrecognized field names back into the terminal's input stream without adequa...

PT-2026-99872

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.34.0 Description An unsafe reflection issue exists in the FederationStreamConnectMessage.getFederationPolicy function. The system calls Class.forNameclazz.getConstructor.newInstance using a clazz val...

CVE-2026-101292: Use of Externally-Controlled Input to Select Classes or Code

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-53610

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...