EUVD-2026-101732

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-18661

In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...

CVE-2026-96614: Improper Authorization in Handler for Custom URL Scheme

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-109131: Improper Neutralization of Input During Web Page Generation

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI built from upstream ansible-ui, frontend/hub renders a documentation URL part formatPartURL in DocumentationParsers.tsx as a link without restricting the URL protocol/scheme. A collection whose...

CVE-2026-110849

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-110857

The GitPython library (versions before 3.2.0 ) is vulnerable to remote code execution due to a lack of check_unsafe_protocols validation in the Git.ls_remote function. Attackers can exploit this by supplying ext:: remote-helper URLs to execute commands, provided that the underlying git installati...

CVE-2026-110849

The n8n platform (versions before 1.123.83 , 2.41.4 , and 2.42.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw in the file-preview modal . The root cause is that the application re-publishes binary data as an unsandboxed same-origin blob URL . An attacker who uploads a crafted item ...

CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-54702 Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

EUVD-2026-101585

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

Serein

Serein | In the Dusk of Rain | Project Updates Suspended Linux English version is online! | Linux English Version is Now Available! http://github.com/W01fh4cker/SereinLinux Disclaimer | Declaration This project is for authorized use only. Any illegal operations using this project are strictly...

CVE-2026-76083 Redash: JSON data source query URL can bypass base URL restriction

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

CVE-2026-102037

An XML Injection vulnerability in the Unified Threat Management daemon utmd of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server...

wp-CVE-2017-5487-exploit

WordPress CVE-2017-5487 Exploit in Python Usage Examples: python3 krpexploit.py -h python3 krpexploit.py --url http://examplesite.com...

EUVD-2026-101362

An XML Injection vulnerability in the Unified Threat Management daemon utmd of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server...

CVE-2026-102037

An XML Injection vulnerability exists in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices. This flaw allows an unauthenticated network attacker to commit arbitrary device configurations with root privileges . The attack is triggered via a malicious re...

CVE-2015-1635_PoC

usage: python3 CVE-2015-1635PoC.py e.g. python3 CVE-2015-1635PoC.py http://www.xxx.com...

CVE-2026-101896 Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty...

CVE-2026-101896 Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty...