GHSA-C23Q-FW86-9H5X LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. Details In internal/plugin/native/manager.go, the plugin installation endpoint...

LF Edge eKuiper: SSRF in External Service

Summary Server-side request forgery SSRF vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces localhost, or cloud...

GHSA-PQQC-8V73-9GG2 LF Edge eKuiper: SSRF in External Service

Summary Server-side request forgery SSRF vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces localhost, or cloud...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

CVE-2026-47837

A flaw was found in Spring Cloud Config Server. This vulnerability allows an unauthenticated remote attacker to send webhook requests to the /monitor endpoint without validation. This lack of authentication for a critical function could lead to a denial of service DoS condition, making the server...

Hijack-service-binaries

Hijack-service-binaries Una herramienta de auditoría de seguridad en PowerShell que identifica binarios de servicios de Windows que pueden ser modificados por el usuario actual, un posible vector de escalada de privilegios. Overview Este script escanea todos los servicios de Windows excepto...

DRUPAL-CONTRIB-2026-149

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...

CVE-2025-58360-GeoServer-XXE

CVE-2025-58360: Laboratorio XXE de GeoServer Inyección no autenticada de entidad externa XML XXE en los servicios OWS/WMS de GeoServer CVSS: 9.8 CRITICAL Afectadas: SLDHandler.parse | | - SLDParser.parseSLD | -- NO Entity...

DRUPAL-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

DRUPAL-CONTRIB-2026-147

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity...

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

PoC_CVE-2025-11579

PoC CVE-2025-11579 Resumen Las versiones = 2.1.1 de rardecode no restringen el tamaño del diccionario al leer tamaños de diccionario RAR grandes, lo que permite a un atacante proporcionar un archivo RAR especialmente diseñado y causar una Denegación de Servicio mediante un fallo por Agotamiento d...

SOC-L1-OSINT-Investigation-MikroTik-CVE-2018-1156

Investigación de Amenazas SOC L1: Múltiples Servicios Expuestos en MikroTik RouterOS Analista: Jonatan Alexander Guerrero Gomez | Rol Objetivo: SOC L1 / Analista de Ciberseguridad Jr. Estado: Investigación Cerrada | Severidad: Alta Resumen Ejecutivo Ejercicio proactivo de caza de amenazas que...

CVE-2026-40635

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering...

DRUPAL-CONTRIB-2026-135

This module enables you to turn a Drupal install into the Central Authentication System CAS Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.18 Vulnerability Details CVEID:CVE-2026-45819 DESCRIPTION: baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process...

CVE-2026-87822

A flaw was found in t-digest. A remote attacker can exploit a vulnerability in the MergingDigest.fromBytes deserialization process by injecting specially crafted "Not a Number" NaN values. These malicious values bypass validation checks, degrading sorting performance from efficient to significant...

CVE-2026-40635

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering...

CVE-2026-40635

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an insecure temporary file vulnerability. A low-privileged remote attacker could potentially exploit this to achieve denial of service and information tampering , with a CVSS 3.1 base score of 5.4 (MEDIUM) . Exploitation details are...