CVE-2026-91199

Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2019-12744

CVE-2019-12744 情報 エクスプロイトタイトル: SeedDMS バージョン 5.1.11 未満における、検証されていないファイルアップロードによるリモートコマンド実行 CVE: CVE-2019-12744 ベンダーホームページ: https://www.seeddms.org/index.php?id=2 エクスプロイト作者: NobodyAtall テスト済みバージョン: Seeddms 5.1.10, 5.0.11 テスト済みOS: Windows 7 x64 Medium記事...

CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup

Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...

EUVD-2026-78076

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-47256

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-62737

CVE-2026-62737 — ExecutionContext.sys Arbitrary Kernel Call Proof of concept for CVE-2026-62737: ExecutionContext.sys invokes a user-controlled TaskFn pointer in kernel mode without validation, producing a controlled kernel crash. Validated on stock Windows 11 25H2 build 26200.8655, ARM64: 0x7E...

CVE-2026-86836

Eclipse Ankaios versions 0.1.0 through 1.0.2 are affected by a local privilege escalation issue in the agent's handling of Control Interface named pipes (FIFOs) . The agent creates workload files and FIFOs under a predictable path derived from the agent name and a hash of the workload's runtime c...

CVE-2026-47256

The OpenTelemetry Collector Contrib Sentry exporter (prior to v0.154.0 ) interpolates the remote OTLP sender-controlled service.name resource attribute into Sentry API URLs without runtime validation. The projectSlugRegexp is applied only at config time, never to runtime-derived slugs. This allow...

EUVD-2026-77692

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-15923

The Zephyr SDIO subsystem function sdioiorwextendedhelper in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MINremaining, func-cis.maxblksize as the per-iteration step. The value func-cis.maxblksize is decoded directly from the SDIO card's CIS FUNCE tuple in sdiodecodec...

CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-54529

SQLAdmin , a Python admin interface for SQLAlchemy models, is vulnerable to an information-exposure ordering oracle via the unvalidated sortBy query parameter in ModelView.sort_query() (prior to 0.27.1 ). The root cause is that column_sortable_list is enforced only in the frontend template to dec...

CVE-2026-57115

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrapepage validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without...

CVE-2026-21018

SveService バッファオーバーフロー Samsung SMR 2026年5月 SVE-2026-0478CVE-2026-21018 影響を受けるバージョン: Android 14、15、16 開示状況: 非公開 SMR 2026年5月リリース1より前のSveServiceにおける領域外書き込みにより、ローカルの特権攻撃者が任意のコードを実行できる可能性があります。 このパッチは適切な入力検証を追加します。 警告: これは教育目的専用の Proof-Of-Concept PoC です。学習以外の目的で行ういかなる行為についても私は責任を負いません。ご注意ください。 これは...

CVE-2026-82426 Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-82426

Apache Storm 's Nimbus component allowed an arbitrary file read via the uploadedJarLocation argument in submitTopology/submitTopologyWithOpts. The path was opened server-side without verifying it referred to a file the caller had uploaded, since the uploaders map was never consulted at submit tim...

CVE-2026-82441

Apache Storm Nimbus accepts unvalidated dependency_jars and dependency_artifacts key lists from topology submissions, leading to two distinct issues. First, during topology cleanup Nimbus deletes the listed keys under its own subject (bypassing the blobstore ACL check), so a submitter can delete ...

EUVD-2026-77486

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...