4485741 matches found
CVE-2026-84961
A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security TLS certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently...
CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-61608
SolidInvoice , an open-source invoicing platform, is affected by a flaw in its UserInvitation entities prior to version 3.0.1 . The root cause is the absence of an expiry timestamp on invitation tokens, causing mailed invitation links to remain valid indefinitely. An attacker who obtains a leaked...
EUVD-2026-71622
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-19534
A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...
CVE-2024-58376
A flaw was found in Renovate's helmv3 manager. This command injection vulnerability allows an attacker with commit access to a repository to execute arbitrary commands. By manipulating registryAliases keys with unquoted shell metacharacters, an attacker can inject commands during helm repo add...
SOC-Log-Monitoring-Threat-Detection-System
🛡️ SOC Log Monitoring & Threat Detection System !Javahttp...
herpaderping
Process Herpaderping Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself. Summary Generally, a security product takes action on process...
CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...
CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...
EUVD-2026-71621
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...
CVE-2026-61686
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1 , the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize() after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP s...
CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...
Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage.
The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a...
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.32, 0.8.41...
NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...