EUVD-2026-95209

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to...

CVE-2026-107706 Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to...

CVE-2026-106436

The MongoDB PHP Driver contains a vulnerability in its BSON encoder caused by unchecked return values when a document exceeds the libbson size limit. This flaw can leave the encoder in an invalid state, allowing an unauthenticated actor to trigger a denial of service by terminating the PHP worker...

http-protocol-exfil

http-protocol-exfil Use the HTTP protocol version to send a file bit by bit "HTTP/1.0" is a 0 and "HTTP/1.1" is a 1. It uses GET requests so the Blue Team would only see the requests to your IP address. However, it takes a long time to send bigger files, for example it needs 1 hour to send 200 KB...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

CVE-2026-105404

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not properly escaped or trimmed when written to output. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

urlbuster

██╗ ██╗██████╗ ██╗ ██████╗ ██╗ ██╗███████╗████████╗███████╗██████╗ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║██╔════╝╚══██╔══╝██╔════╝██╔══██╗ ██║ ██║██████╔╝██║ ██████╔╝██║ ██║███████╗ ██║ █████╗ ██████╔╝ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║╚════██║ ██║ ██╔══╝ ██╔══██╗ ╚██████╔╝██║...

EUVD-2026-43178

PraisonAI: Crawl4AI/Chromium backend is also affected by the webcrawl SSRF validation bypass...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

CVE-2026-106577

The open-source image manipulation software ImageMagick is vulnerable to code injection in its PostScript coders. The root cause is the processing of unescaped or untrimmed values , which allows for the injection of code into the output generated by these coders. This vulnerability affects versio...

CVE-2026-103008

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

CVE-2026-105800

A flaw was found in i18next-http-backend. A remote attacker can supply crafted language or namespace values to applications configured with custom translation path templates that begin directly with placeholders. This manipulation causes the application to generate unintended external web...

EUVD-2026-93938

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

CVE-2026-103008 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

CVE-2026-103008 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

CVE-2026-103008

Elasticsearch is vulnerable to Uncontrolled Recursion (CWE-674) , which can lead to a Denial of Service (DoS) . The root cause is an unbounded recursion depth when building and serializing geometry values produced by scripted runtime fields . While text-supplied geometry has nesting limits, geome...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth...

CVE-2026-105863

The headless content management system Payload is vulnerable in versions after 3.0.0 and before 3.90.0 . The root cause is a custom field option that allows a field to be mapped to a reserved authentication claim name , which can cause unintended values to be placed in the authentication token is...