tetsuo-pulse

सॉकेट लाइब्रेरी परिपक्वता सूचना : यह लाइब्रेरी कार्यात्मक और अच्छी तरह से परीक्षित है लेकिन हाल ही में जारी की गई है। यह विकास, आंतरिक उपकरणों और नियंत्रित वातावरण के लिए उपयुक्त है। अविश्वसनीय नेटवर्क इनपुट के साथ उत्पादन परिनियोजन तब तक प्रतीक्षा करनी चाहिए जब तक कि कोडबेस में वास्तविक दुनिया क...

CVE-2026-47834

CVE-2026-47834 affects Spring Data JPA versions 4.1.0 , 4.0.0–4.0.6 , 3.5.0–3.5.13 , and 3.0.0–3.4.15 . The vulnerability allows bypass of Sort expression validation when crafted payloads are accepted from untrusted sources, potentially leading to low confidentiality and low availability impact. ...

CVE-2026-47834 Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

EUVD-2026-66676

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-18252 Inclusion of Functionality from Untrusted Control Sphere in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

CVE-2026-18252

GitLab EE (versions 18.9 through 19.3) is affected by a vulnerability where the Claude agent processes configuration from a user-controlled source, allowing an authenticated user with developer-role permissions to execute arbitrary commands in a CI context. The root cause is the inclusion of func...

CVE-2026-63041

Apache APISIX's attach-consumer-label plugin fails to strip client-supplied consumer-label headers, allowing an authenticated attacker to escalate privileges or bypass authorization by sending crafted values. The vulnerability affects versions 3.11.0 through 3.17.0 and is fixed in 3.18.0 . NVD ra...

CVE-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2023-32571

🐞 CVE-2023-32571 - Execução Remota de Código no System.Linq.Dynamic.Core Prova de Conceito para CVE-2023-32571, uma vulnerabilidade de execução remota de código no System.Linq.Dynamic.Core 1.0.7.10 a 1.2.25. Esta vulnerabilidade permite que atacantes executem código e comandos arbitrários quando...

VUL4J-60

antisamy अविश्वसनीय स्रोतों से आने वाले HTML का तेज़, कॉन्फ़िगरेबल सफाई करने के लिए एक लाइब्रेरी। इसे दूसरे शब्दों में कहा जा सकता है: यह एक API है जो आपको यह सुनिश्चित करने में मदद करता है कि क्लाइंट अपने प्रोफ़ाइल, टिप्पणियों आदि के लिए दिए गए HTML में दुर्भावनापूर्ण कार्गो कोड न डालें, जो सर्व...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098758)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098758 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: replace BUGON with bounds check for map-maxosd OSD indexes come from untrusted network...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pyyaml (UTSA-2026-093159)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093159 advisory. A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML...

PT-2026-82213

Name of the Vulnerable Software and Affected Versions bestzip versions prior to 2.2.6 bestzip versions prior to 3.0.2 Description The software constructs the argument list for the system zip utility without separating options from operands. Because the destination archive path and caller-supplied...

EUVD-2026-37015

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads...

Wazuh Server 4.0.0 < 4.14.6 Multiple Vulnerabilities

The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.6. It is, therefore, affected by multiple vulnerabilities, including: - cluster.unmergeinfo constructs paths from peer-controlled mergetype and name values in a merged synchronization archive. A cluster peer holdin...

CVE-2026-53532 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted input...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...