304137 matches found
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests...
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses...
PT-2026-79200
Name of the Vulnerable Software and Affected Versions Microsoft Exchange Online affected versions not specified Description Server-side request forgery SSRF allows an unauthorized attacker to elevate privileges over a network. SSRF is a flaw where an attacker can induce the server to make request...
TrueConf Server Code Injection Vulnerability
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details...
cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure
cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...
SNet
SNet 日本語版はこちら / Versione giapponese Un CTF dove usi l'AI per catturare la bandiera. Nessuna esperienza di pentesting? Nessun problema. Claude Code funge da tuo personal trainer — configura l'ambiente, ti insegna gli strumenti e ti guida attraverso tecniche di attacco reali passo dopo passo. Scriv...
CVE-2026-76404
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...
CVE-2026-76389
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...
CVE-2026-76316
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...
CVE-2026-63123
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...
GHSA-RGR9-R7MJ-MF6X Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...
EUVD-2026-62971
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...
CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...
CVE-2026-76404 Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...
CVE-2026-76404
The Splunk MCP Server app deserializes stored credential data without type validation, allowing an admin-role user to trigger arbitrary OS command execution. Affected versions are below 1.2.1; no exploitation evidence is provided. Update to version 1.2.1 to remediate. Splunk advisory: https://adv...
CVE-2026-76316 Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...
CVE-2026-76316
An unauthenticated remote attacker who can reach the Splunk management port can register a crafted Deployment Server client identifier, which is then inserted into dispatched searches without special-character sanitization. When an administrator opens the Add Data forwarder workflow, the injected...