CVE-2025-5777-CitrixBleed

CVE-2025-5777-CitrixBleed CitrixBleed-2 CVE-2025-5777 – NetScaler ADC/Gateway “메모리 블리드”에 대한 개념 증명 익스플로잇 CVE-2025-5777은 Citrix NetScaler ADC/GatewayGateway 또는 AAA vServer 모드에서 인증되지 않은 심각한 out-of-bounds 읽기 취약점입니다. 단일 조작된 요청으로 세션 토큰이 포함된 메모리를 덤프하여 전체 인증 우회를 가능하게 하며, 이로 인해 “CitrixBleed 2”라는 별명을 얻었습니다...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

vertx-web-xsrf

개요 io.vertx.ext.web.handler.impl.CSRFHandlerImpl Vert.x Web의 CSRFHandlerImpl은 사용자 세션별로 고유한 CSRF 토큰을 생성하지 않습니다. 악의적인 웹사이트는 유효한 CSRF 토큰을 획득하여 HTML 폼에 추가한 후 취약한 웹 애플리케이션에 폼을 제출함으로써 CSRF를 여전히 수행할 수 있습니다. 현재, 사전 검증pre-flight CORS OPTIONS HTTP 요청이 XMLHTTPRequests를 통한 CSRF를 방지하지만, 사전 검증 요청을 우회할 수 있는 방법이...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664

MISP is vulnerable to reflected cross-site scripting (XSS) in the analyst data notes panel. The root cause is the lack of sanitization or type enforcement on the seed path parameter supplied via the URL, which is passed directly into inline JavaScript within the HTML response. An authenticated at...

CVE-2025-5777

CVE-2025-5777 — Citrix NetScaler「CitrixBleed 2」メモリ情報漏えい Sentinel AI Defense による調査レポート。防御目的の分析のみ — 実働するエクスプロイト や PoC はここでは公開されていません。 初代 CitrixBleed の続編: NetScaler ADC/Gateway の認証エンドポイントにおける境界外読み取りで、 認証されていない攻撃者に対し、サーバーメモリの断片（セッショントークンを 含む）を HTTP レスポンスとしてそのまま返してしまいます。 📄 詳細レポート:...

CVE-2026-100862

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

EUVD-2026-87827

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862

The workflow automation platform heym versions prior to 0.0.91 contains multiple plaintext storage vulnerabilities. The application fails to encrypt several sensitive secrets, including webhook header-auth values , MCP API keys , portal session tokens , workflow execution JWTs , and Discord inter...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862: Cleartext Storage of Sensitive Information

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

EUVD-2026-86349

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

CVE-2026-82371

Brocade SANnav versions before 3.0.1a are vulnerable to a plaintext exposure of sensitive authentication data within the discovery service log files . This flaw allows individuals with file read access to retrieve administrative switch credentials and active session tokens . An attacker who gains...

CVE-2026-82371 Plaintext exposure of sensitive authentication data in SANnav discovery service log files

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

PT-2026-98228

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Sensitive authentication data is exposed in plaintext within the discovery service log files. Individuals with file read access, such as those with access to system logs or support bundles, c...