PT-2026-92059

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filter untrusted fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image save dir paths to write attacker-controll...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

HTTP Response Splitting

Overview eventsource-encoder is an Encodes events as well-formed EventSource/Server Sent Event SSE messages Affected versions of this package are vulnerable to HTTP Response Splitting via unsanitized event and id fields in the encoding process. An attacker can inject arbitrary Server-Sent Events...

Kiwi TCMS Operating System Command Injection Vulnerability

Kiwi TCMS is Kiwi TCMS open source a leading open source test management system for manual and automated testing. An operating system command injection vulnerability exists in versions of Kiwi TCMS prior to 12.2 that stems from the use of untrusted fields and can be exploited by an attacker to...

Kiwi TCMS 操作系统命令注入漏洞

Kiwi TCMS is Kiwi TCMS open source a leading open source test management system for manual and automated testing. An operating system command injection vulnerability exists in versions of Kiwi TCMS prior to 12.2 that stems from the use of untrusted fields and can be exploited by an attacker to...

Google Android Qualcomm closed-source component integer overflow vulnerability (CNVD-2019-24146)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An integer overflow vulnerability exists in the Qualcomm closed source component in Android. An attacker can exploit this vulnerability to integer overflow untrusted fields in GNSS XTRA3...