CVE-2026-39987_PoC

CVE-2026-39987-PoC Disclaimer This script is for educational and authorized testing purposes ONLY. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for any misuse of this information. Marimo versions prior to 0.23.0 have a critica...

br.gov.frameworkdemoiselle.component:demoiselle-report (>=2.0.5, <=2.2.0), net.sourceforge.dynamicreports:dynamicreports-core (>=2.1.0, <=2.2.0) +7 more potentially affected by CVE-2026-6009 via net.sf.jasperreports:jasperreports (4.0.1)

net.sf.jasperreports:jasperreports MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.jasperreports:jasperreports and may be impacted: - br.gov.frameworkdemoiselle.component:demoiselle-report =2.0.5, =2.1.0, =2.0, =2.0, =2.0,...

EUVD-2026-19190

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

Arbitrary Code Injection

Overview gpt-researcher is a GPT Researcher is an autonomous agent designed for comprehensive web research on any task Affected versions of this package are vulnerable to Arbitrary Code Injection in the extractcommanddata function of the /ws endpoint. An attacker can execute arbitrary code by...

CVE-2026-5633

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-5633 assafelovic gpt-researcher ws Endpoint server-side request forgery

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-5631 assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection

A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extractcommanddata of the file backend/server/serverutils.py of the component ws Endpoint. Such manipulation of the argument args leads to code injection. The attack may be performed from remote. T...

CVE-2026-5631

A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extractcommanddata of the file backend/server/serverutils.py of the component ws Endpoint. Such manipulation of the argument args leads to code injection. The attack may be performed from remote. T...

CVE-2026-5633: Server-Side Request Forgery (SSRF)

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-5631: Improper Control of Generation of Code

A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extractcommanddata of the file backend/server/serverutils.py of the component ws Endpoint. Such manipulation of the argument args leads to code injection. The attack may be performed from remote. T...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the WebSocket session handling in kernel/util/websocket.go. An attacker can connect to the /ws endpoint and receive real-time document metadata and activity events by using the special id=auth WebSocket...

br.gov.frameworkdemoiselle.component:demoiselle-report (>=2.0.5, <=2.2.0), net.sourceforge.dynamicreports:dynamicreports-core (>=2.1.0, <=2.2.0) +7 more potentially affected by CVE-2025-10492 via net.sf.jasperreports:jasperreports (4.0.1)

net.sf.jasperreports:jasperreports MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.jasperreports:jasperreports and may be impacted: - br.gov.frameworkdemoiselle.component:demoiselle-report =2.0.5, =2.1.0, =2.0, =2.0, =2.0,...

OpenJDK JAX-WS service endpoint remote Denial-of-Service (6630639)

Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit JDK and Java Runtime Environment JRE 6 Update 12 and earlier allows remote attackers to cause a denial of service probably resource consumption for a JAX-WS service endpoint via a connection without...

OpenJDK JAX-WS service endpoint remote Denial-of-Service (6630639)

Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit JDK and Java Runtime Environment JRE 6 Update 12 and earlier allows remote attackers to cause a denial of service probably resource consumption for a JAX-WS service endpoint via a connection without...