CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-12894

The Qute template engine in Quarkus is vulnerable to server-side template injection (SSTI) via the ReflectionValueResolver component, which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence t...

CVE-2026-12894 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

EUVD-2026-68505

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-12894 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.5...

CVE-2026-42588

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

CVE-2026-49003

CVE-2026-49003 is an unauthenticated command injection vulnerability in ZTE ZXDU68 S202 V5.0 , a power system product. Attackers on an adjacent network can exploit it without credentials to delete core system runtime files, causing the monitoring module to crash . They can also escalate to root p...

CVE-2026-71513

A flaw was found in NLTK. A remote attacker can achieve remote code execution by crafting untrusted transition-parser models. This vulnerability exists in the AllowlistUnpickler, which incorrectly validates only the pickle module string and not the global name. This allows attackers to bypass the...

Atlassian Confluence - Remote Code Execution

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server...

CVE-2026-60004-Gitea-RCE-PoC

🫖 CVE-2026-60004 — Gitea RCE PoC A direct, single-target validation tool for Gitea's diffpatch Git-hook remote code execution vulnerability. This repository contains the focused AfterDark validator: one script, one target, one run. There are no discovery, reconnaissance, verification, or other...

CVE-2026-60004-Gitea-Validator

🫖 CVE-2026-60004 Gitea Validator A standalone discovery, assessment, and contract-correlated validation tool for the Gitea diffpatch Git-hook remote code execution vulnerability. scanner.py gives penetration testers, defenders, and security researchers one dependency-free tool for: 🔎 Passive Gite...

FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...

CVE-2026-82673

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

seans-surf-and-skate

Sean's Surf & Skate Co. — सील सिक्योरिटी डेमो Maven / Java स्प्रिंग बूट के साथ बनाया गया एक छोटा लेकिन वास्तविक दिखने वाला ई-कॉमर्स स्टोरफ्रंट "Sean's Surf & Skate Co."। यह ज्ञात कमज़ोरियों वाली ओपन-सोर्स डिपेंडेंसियों के साथ आता है ताकि इसका उपयोग यह प्रदर्शित करने के लिए किया जा सके कि Seal...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...

CVE-2026-82673

ash-project ash_admin versions 0.13.7 through 1.3.0 are vulnerable to a path traversal in the file upload handler. The function AshAdmin.Components.Resource.Form.consume_file_uploads/1 constructs the upload destination using Path.join/1 with the browser-supplied filename without sanitization, all...

EUVD-2026-68331

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...