CVE-2026-76561 Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...

CVE-2026-76561

CVE-2026-76561 affects Dogtag PKI (pki-core), the certificate authority component used by FreeIPA . The certificate profile import functionality fails to fully validate uploaded profile content beyond the profile ID, allowing an authenticated user with CA Administrator privileges to exploit the E...

CVE-2026-76561

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...

CVE-2026-71374 Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...

CVE-2026-71374

CVE-2026-71374 is a deserialization of untrusted data vulnerability in Hitachi Cosminexus Component Container , rated CVSS 9.8 (CRITICAL) with a network attack vector requiring no privileges and causing high impact to confidentiality, integrity, and availability. The vulnerable versions span from...

CVE-2026-71374 Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...

EUVD-2026-72653

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses ITOM Rel 3.0.0: idna-3.11-py3-none-any.whl which are vulnerable to CVE-2026-45409. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Names ...

CVE-2024-1561

CVE-2024-1561 - Gradio 任意文件读取 CVE-2024-1561 是一个影响 Gradio 4.13.0 之前版本 的任意文件读取漏洞。Gradio 是一个流行的 Python 框架，用于快速为机器学习模型和 AI 应用构建 Web 界面。 该漏洞的成因在于 /componentserver 端点未能正确限制内部 Component 类中可被调用的方法。攻击者可以利用这一行为来调用那些本不应通过 HTTP 暴露的方法。 其中一种方法 moveresourcetoblockcache 允许将本地文件系统中的文件复制到 Gradio...

uaf-2023-28205

CVE-2023-28205：Apple WebKit 释放后使用漏洞 该漏洞影响 Apple WebKit，可通过恶意构造的 Web 内容加以利用，并有可能在 WebKit 进程上下文中执行任意代码。 本仓库中所分析的受影响 WebKit 构建基于 WebKit-613.1.17.1 （PlayStation / Safari 15.4 系列）。 描述 该概念验证通过在结构化克隆操作期间有意延迟注册 Map 和 Date 等 JavaScript 对象，从而触发释放后使用（UAF）条件。 这一时间窗口使 JavaScriptCore 垃圾回收器（GC）...

Security Bulletin: Vulnerability in IBM SDK affectecting Rational Business Developer

Summary There are vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU plus four additional vulnerabilities used by Rational Business Developer. Rational Business Developer has provided fixes for the applicable CVEs. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS...

mitigate-cve-2026-23869-react-server-component-loops

如何修复 CVE-2026-23869：缓解 React 服务端组件循环 保护现代企业前端应用需要持续监控服务端数据获取布局和框架组件生命周期。随着 CVE-2026-23869 的近期公开披露，工程团队正面临与 React 服务端组件内不受控制的渲染循环相关的严重漏洞。这一关键安全漏洞允许未经身份验证的网络请求触发递归渲染状态，从而瞬间耗尽后端服务器内存层。若未及时修补，一波自动化利用流量可能导致应用程序容器永久冻结，并在云基础设施中造成全面的网络拒绝服务日志。 为确保您的部署流水线安全，Web...

cve-2025-9951-ffmpeg-jp2-poc

CVE-2025-9951 FFmpeg JPEG 2000 Exploitation Research This repository contains two deliberately separated exploitation milestones for the FFmpeg JPEG 2000 component-mapping vulnerability: 1. 01-gdb-assisted/ — the original deterministic GDB-launched PoC and its full research-journey writeup,...

Exploit for CVE-2026-75650

CVE-2026-75650 / VULN-39341 Docker validation lab This standa...

CVE-2026-86519

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...