CVE-2026-100187

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...

CVE-2026-100187

The Onion module in the AIL Framework is vulnerable to a logic flaw in its URL extraction process. The software uses a performance shortcut that validates .onion targets based only on a 69-character length and a ".onion" suffix , failing to perform proper hostname parsing or domain validation. An...

CVE-2026-100187 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...

CVE-2026-59160

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...

CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

EUVD-2026-62540

Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge...

Customization under Fire: Plugin Poisoning in Text-To-Image Ecosystem

The prosperity of text-to-image T2I models has fostered a vibrant share-and-play ecosystem centered on Low-Rank Adaptation LoRA plugins, which allow users to customize and share model capabilities with ease. This democratization, however, comes with a hidden but severe security risk. Malicious...

EUVD-2020-29060

Malware in sbrugna...

CVE-2020-8179

Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...

Nextcloud Deck Access Control Error Vulnerability

Nextcloud Deck is a Kanban-style organization tool developed by Nextcloud, Inc. designed for individual planning and project organization for teams integrated with Nextcloud. An access control vulnerability exists in Nextcloud Deck version 1.0.0. An attacker can exploit the vulnerability to injec...

CVE-2020-8179

CVE-2020-8179 affects Nextcloud Deck 1.0.0. The root cause is an improper access control in the deck task/move flow: updating a card’s stackId via /apps/deck/cards/{id} does not enforce that the destination belongs to the requester, allowing an attacker to inject tasks into another user’s deck. T...