grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...

CVE-2026-92141

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...

CVE-2026-92135

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-74909

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

CVE-2026-92141

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...

CVE-2026-92141

The Jenkins Keycloak Authentication Plugin versions 2.4.1 and earlier do not restrict the redirect URL after login. An attacker can craft a Jenkins URL that, after a successful authentication, forwards the user to an arbitrary external site, enabling phishing attacks . The vulnerability is classi...

EUVD-2026-80765

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...

CVE-2026-92135

Jenkins Coverage Plugin versions 3.3358.v9487dde48783 and earlier do not validate the coverage results ID when a job configuration is submitted through the REST API. Attackers with Item/Configure permission can use a javascript: scheme URL as the identifier, resulting in a stored cross-site scrip...

EUVD-2026-80759

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-92134

Jenkins Warnings Plugin (warnings-ng) version 13.10258.va_17d49a_78c3b_ and earlier fails to validate the analysis results ID when a job configuration is submitted through the REST API. An attacker with Item/Configure permission can inject a javascript: scheme URL as the identifier, resulting in ...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2025-20384

SPLUNK CVE-2025-20384 i dunno, i just read stuff my friendo sent to me and start typing down some random sorry ass nub javascript code Log Injection/Forgery/Poisoning/Obfuscate type POC Please read this arcticle OWASP Log Injection TL;DR Look for static file, passed it and append some random...

CVE-2025-21385

SSRF Exploit Script This repository contains a script designed to perform an SSRF Server-Side Request Forgery exploit for testing and educational purposes. Use this tool responsibly and only in environments where you have explicit permission. Features Exploit SSRF vulnerabilities in target system...

CVE-2024-9933

CVE-2024-9933 Usage Usage: python CVE-2024-9933 .py option URL Options: check : Verify if the target URL is vulnerable. exploit : Attempt to exploit the vulnerability on the provided URL. Examples: python CVE-2024-9933 .py check http://example.com python CVE-2024-9933 .py exploit http://example.c...

Follina_MSDT_CVE-2022-30190

Microsoft explains that “a remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker ca...

CVE-2025-63441

CVE-2025-63441 Title: Reflected XSS via arbitrarily supplied URL parameter param at endpoint u/administrator/friends Summary: A Reflected Cross-Site Scripting XSS vulnerability was identified in the u/administrator/friends endpoint of the OSSN application. This vulnerability allows attackers to...

CVE-2021-36798

CVE-2021-36798 CVE-2021-36798 Cobalt Strike 4.3 dos Использование root@kitploit: python3 CVE-2021-36798.py BeaconURL Чтобы вывести из строя Cobalt Strike, достаточно одного пакета Протестировано: 4.3, 4.2 Ссылки:...