NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server vulnerability discovered by ? in WordPress Npm quasar versions = 2.23.2...

EUVD-2026-94452

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

CVE-2026-76437 Cisco Smart Software Manager On-Prem Command Injection Vulnerability

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

CVE-2025-0133

CVE-2025-0133 Palo Alto PAN-OS GlobalProtect 게이트웨이 및 포털의 getconfig.esp 핸들러에서 발견된 반사형 XSS 취약점입니다. user 쿼리 매개변수가 Captive Portal 페이지에 인코딩되지 않고 반영됩니다. 인증된 GlobalProtect 사용자를 조작된 링크로 유인한 공격자는 기업 VPN 포털의 신뢰 컨텍스트에서 JavaScript를 실행할 수 있으므로 피싱 캠페인이 훨씬 더 효과적이게 됩니다. 2025년 5월에 공개되었습니다. PAN-SA-2025-0005에서...

CVE-2026-106560 Backstage: Improper repository path validation in a Scaffolder backend module

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

EUVD-2026-94373

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

EUVD-2026-87369

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

GHSA-RJPF-7PF5-Q54X wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

CVE-2024-37081

CVE-2024-37081: VMware vCenter Server의 다중 로컬 권한 상승 취약점 vCenter Server는 sudo의 잘못된 구성으로 인해 여러 로컬 권한 상승 취약점을 포함하고 있습니다. 인증된 로컬 사용자가 비관리자 권한으로 이러한 문제를 악용하여 vCenter Server Appliance에서 루트 권한으로 상승시킬 수 있습니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개는 여기에서 확인할 수 있습니다. 요구 사항: 이 취약점을 악용하려면 다음이 필요합니다: 잘못 구성된 sudo 사용자 또는...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation에서 메모리 API에 소유권 검사가 누락되어 교차 사용자 메모리 읽기 및 삭제가 가능했습니다. 기본 권고: GHSA-qv97-83w4-ff86 연구자 크레딧: @chaitanyagarware 한눈에 보기 필드| 값 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 프로젝트| vmDeshpande/ai-agent-automation 패키지| backend 생태계| npm 심각도| 높음 CVSS| 8.8,...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA LM 구성 마법사 인증 우회 일반 및 관리자 Java 사용자 생성 SAP NetWeaver는 SAP Business Suite 이후 모든 SAP 애플리케이션의 기술적 기반이 되는 SAP의 통합 기술 플랫폼입니다. SAP NetWeaver는 SAP 애플리케이션을 위한 개발 및 실행 환경을 제공하는 서비스 지향형 애플리케이션 및 통합 플랫폼으로, 맞춤형 개발과 다른 애플리케이션 및 시스템과의 통합에도 사용할 수 있습니다. SAP NetWeaver AS JAVALM 구...

CVE-2026-12793

CVE-2026-12793 — JetFormBuilder 未認証の権限昇格 WordPress プラグイン JetFormBuilder — Dynamic Blocks Form Builder Crocoblock における CVE-2026-12793 の概念実証スキャナーおよびエクスプロイト。 | ---|--- CVE| CVE-2026-12793 プラグイン| jetformbuilder 影響を受けるバージョン| ≤ 3.6.2 修正バージョン| 3.6.2.1+ CVSS| 9.8 Critical 認証| 未認証 CWE| CWE-269 — 不適切な権限管理...

CVE-2025-57392

CVE-2025-57392 🔒 セキュリティ脆弱性レポート 製品: BenimPOS Desktop V3.0 脆弱性タイプ: 安全でないファイル権限 影響を受けるコンポーネント: BenimPOS.exe、unins000.exe、System.Data.SQLite.dll 脆弱性クラス: CWE-276: 不適切なデフォルト権限 PoC作成者: Fatih Bülbül テスト環境: Windows 11 x64 – ローカル管理者 + 標準ユーザー 🛠️ 1. 脆弱性の検出...

CVE-2026-97146

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

CVE-2026-92393

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

CVE-2026-42720

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...