CVE-2026-113316

Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-33317

CVE-2026-33317 OP-TEE PKCS11 PoC This repository contains the Normal World proof of concept, reproduction notes, and captured logs for CVE-2026-33317 / GHSA-8cqw-mg7v-c9p9. The official OP-TEE advisory describes missing validation in entrygetattributevalue for PKCS11CMDGETATTRIBUTEVALUE. The bug...

Silverpeas-AuthBypass-CVE-2024-36042

Silverpeas-AuthBypass-CVE-2024-36042 A clean, professional-grade Python3 proof-of-concept for CVE-2024-36042 — an authentication bypass in Silverpeas 6.3.5 caused by missing password validation in AuthenticationServlet. Overview Silverpeas AuthenticationServlet accepts a login request even when t...

EUVD-2026-105354

The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing...

CVE-2026-103672

The PEAK-System PCAN Windows drivers from HMS Networks are vulnerable to an Improper Validation of Array Index (CWE-129). The vulnerability exists because the PCAN parser indexes a length table using attacker-controlled DLC without enforcing the required bound of DLC

CVE-2026-33693

CVE-2026-33693: SSRF via 0.0.0.0 Bypass in activitypub-federation-rust v4isinvalid CVSS 6.5 Moderate Keywords: SSRF, 0.0.0.0, IP validation bypass, activitypub-federation, Lemmy, Rust, ActivityPub Table of Contents Overview Vulnerability Details Technical Analysis Attack Chain Impact Remediation...

CVE-2026-113602

A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute 0x1A character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept...

CVE-2026-87866

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

EUVD-2026-105312

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

A flaw exists in libcurl when used with the libssh2 backend and a hashed known_hosts file . An unrelated initial entry can cause host key validation to incorrectly report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. A remote attacker who intercepts or controls the SSH ...

CVE-2026-87865

When libcurl uses libssh2 with a hashed "knownhosts" file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the "CURLOPTSSHKEYFUNCTION" callback...

CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-112942

A flaw was found in launch-editor. This vulnerability can allow a remote attacker to achieve arbitrary command execution on Windows systems. By submitting a specially crafted file path containing line and column suffixes, an attacker can bypass file existence checks due to improper path validatio...

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are neede...

GHSA-46JR-4WX8-V453 MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are neede...

CVE-2026-113657

A flaw was found in sanitize-html. This vulnerability allows a remote attacker to achieve arbitrary script execution when an application is configured to permit namespace-prefixed Scalable Vector Graphics SVG animation elements. By submitting specially crafted SVG markup, an attacker can bypass U...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...

CVE-2026-85087

A flaw was found in Apache Thrift's Python bindings. Due to improper certificate validation and incorrect status code handling, client applications fail to properly verify the authenticity of a remote server during encrypted connections. A remote attacker in a man-in-the-middle position could...

GitLab-CVE-2021-22205-

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Affected Version Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE...