CVE-2026-106185

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-93841

Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106346

Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106396

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty

Summary IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host a...

CVE-2026-31156

CVE-2026-31156 OpenPLC-v3에는 명령줄에서 전달된 파일 경로 매개변수에 대한 유효성 검사를 수행하지 않아 발생하는 경로 주입 취약점이 있습니다. 공격자는 악성 경로를 구성하여 읽을 수 있는 모든 파일을 읽을 수 있으며, 정보 유출 위험이 있습니다. Vulnerability Type 잘못된 입력 검증 경로 주입 정보 공개 임의 파일 읽기 Vulnerability Overview gluegenerator.cpp에서 컴파일된 바이너리 프로그램에는 사용자가 제공한 파일 경로에 대한 검증 부족으로 인한 임의 파일 읽기...

EUVD-2026-93780

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-63697

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-63697

Dell System Update (DSU) versions prior to 2.3.0.0 are affected by an Improper Certificate Validation vulnerability (CWE-295). A high-privileged attacker with remote access could exploit this flaw to achieve Remote execution . The vulnerability specifically affects the DSU tool, which corporate a...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-106114 ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and...

CVE-2026-106114 ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and...

CVE-2023-23924

CVE-2023-23924 Dompdf는 SVG 파싱 시 URI 검증 실패에 취약함 · CVE-2023-23924 · GitHub 보안 권고 데이터베이스 https://github.com/advisories/GHSA-3cw5-7cxw-v5qg 실행 Terminal 1 ❯ cd www ❯ php -S 127.0.0.1:9000 -t . Terminal 2 ❯ cd src ❯ php cve202323924.php 확인 "whoami" 명령이 실행되는지 확인합니다. 2.0.1 ❯ php cve202323924.php PHP...

CVE-2026-105867

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...

CVE-2026-12416-CVE-2026-12417

CVE-2026-12416-CVE-2026-12417 비인증 계정 탈취: 'resetuserid' 파라미터를 통한 취약한 비밀번호 재설정 검증 우회 | 비인증 권한 상승: 'resetactivationcode'를 통한 취약한 비밀번호 재설정 검증 우회로 계정 탈취 CVE-2026-12417 & CVE-2026-12416 — 대량 스캐너 제작자: Khaled Alenazi Nxploited 취약점 CVE-2026-12417 — SignUp & SignIn ≤ 1.0.0 취약한 비밀번호 재설정 검증을 통한 비인증 권한 상승 필드|...

ECC_Attacks

타원곡선 암호에 대한 알려진 공격들 서론 타원곡선 소개 암호학적 맥락에서의 타원곡선 ECC 공격 ECDH 공격 생성자의 위수가 너무 작은 경우 생성자의 위수가 매끄러운 수smooth number인 경우 생성자의 위수가 거의 매끄러운 수이고 개인키가 작은 경우 점이 곡선 위에 있는지 검증하지 않는 경우 곡선이 특이singular한 경우 곡선이 초특이supersingular한 경우 곡선이 비정상anomalous인 경우 ECDSA 공격 메시지에 서명하기 전에 해시하지 않는 경우 서로 다른 서명에서 동일한 k 값을 재사용하는 경우 k...

CVE-2024-34693

CVE-2024-34693: Apache Superset におけるサーバー任意ファイル読み取り Apache Superset の不適切な入力検証の脆弱性により、認証済みの攻撃者が localinfile を有効にした MariaDB 接続を作成できる可能性があります。Superset の MySQL/MariaDB クライアントで localinfile を有効にし、そのクライアントを悪意のある MySQL サーバーに向けることで、攻撃者は "LOAD DATA LOCAL INFILE"（Rogue MySQL Server）攻撃を仕掛け、サーバーからファイルを読み取り、その内...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana 인증되지 않은 파일 읽기 영향 버전: 8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Grafana /public/plugins 인터페이스가 URL 라우팅 검증을 엄격하게 수행하지 않는 취약점을 이용하여 서버 로컬의 임의 파일을 읽습니다. poc: /public/plugins/icon/../../../../../../../../../../../../../../../../../..path 여기...

CVE-2026-106219

JetBrains TeamCity versions prior to 2026.2.1 are vulnerable to an information disclosure issue due to insufficient validation of Git submodule URLs . This flaw allows an attacker to perform unauthorized reading of local repositories hosted on the server. To remediate this vulnerability, users sh...

GHSA-2G7P-5934-Q4W7 Payload: ReDoS in Multipart Content-Type Validation

Impact A malformed multipart request body could take an extremely long time to finish. Patches Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...