CVE-2026-34157

A flaw was found in Wails. The framework's origin validation logic converts wildcard patterns into overly permissive regular expressions, allowing lookalike web origins to bypass access controls when partial or trailing wildcards are configured. A remote attacker controlling a matching domain can...

LoLLMS WebUI < 9.8 - Path Traversal

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /listpersonalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter. id: CVE-2024-4322 info: name: LoLLMS WebUI 9.8 - Path Traversal...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

Strapi Versions <=4.5.5 - SSTI to Remote Code Execution

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. id: CVE-2019-14696 info: name: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting author: pikpikcu severity: medium description: Open-School 3.0, and...

PyTorch TorchServe SSRF

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity...

BeyondTrust Remote Support <= 26.2.3 - Origin Validation File Upload

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. id: CVE-2026-102764...

OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

Kramer VIAware - Remote Code Execution

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames. id: CVE-2021-36356 info: name: Kramer VIAware - Remote Code Execution author: gy741 severity: critical description: KRAMER...

EUVD-2026-117820

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify...

UBUNTU-CVE-2026-121996

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation...

CVE-2026-123323: JetBrains YouTrack: In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host…

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation...

CVE-2026-123846: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation...

CVE-2026-113618: KAMSOFT ZSIRep Client Library: The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation

The ZSIRep client library ZSIREP.CLIENT.DLL is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and...

JetBrains Rider < 2025.3.5.3 / 2026.1.x < 2026.1.5.3 / 2026.2.x < 2026.2.4 Certificate Validation

The version of JetBrains Rider installed on the remote host is prior to 2025.3.5.3, or is 2026.1.x prior to 2026.1.5.3, or is 2026.2.x prior to 2026.2.4. It is, therefore, affected by a certificate validation vulnerability: - In JetBrains Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3...

CVE-2026-123291: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs…

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook...

Oracle Linux 8 : tesseract (ELSA-2026-95725)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-95725 advisory. - Fix incomplete CVE-2026-88051: reset 'sizeused' on validation failure in 'GenericVector::read'; check 'fontinfotable' and 'fontsettable' read return...

CVE-2026-123834: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's…

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account...

Linux Distros Unpatched Vulnerability : CVE-2026-108946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids...

Linux Distros Unpatched Vulnerability : CVE-2026-108500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a...