CVE-2026-49986 Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...

CVE-2026-49986 Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...

CVE-2026-46439

CVE-2026-46439 (compliance-trestle SSTI): A Server-Side Template Injection exists in the TreSTLE tool when running the command trestle author jinja. The vulnerability arises from recursive re-rendering of data-bound templates, allowing an attacker-controlled payload embedded in SSPs or Lookup Tab...

CVE-2026-46439 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

CVE-2014-9495

creationtimestamp| type| source ---|---|--- 2026-08-14 16:00:10+00:00| seen| https://t.me/purpsec/869 2026-08-15 00:00:12+00:00| published-proof-of-concept| https://t.me/purpsec/869...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 — Exploit Development Lab Overview This pr...

Security Bulletin: IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information (CVE-2026-1014)

Summary A sensitive information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2026-1014 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to exposure of sensitive information via JSON server respon...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

EUVD-2026-58670

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879

Undertow contains a vulnerability in the HTTP response header writing path: the writeString() method narrows 16‑bit Unicode to 8‑bit bytes when writing header values, which can truncate characters to ASCII control/symbols and cause limited integrity impact or information disclosure if input isn’t...

CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

CVE-2026-73673

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

ROOT-APP-MAVEN-CVE-2024-8184 CVE-2024-8184 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2024-8184 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-1605 CVE-2026-1605 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2026-1605 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-10051 CVE-2026-10051 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2026-10051 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

EUVD-2026-58623

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673 Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673 Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...