Author name: UNDERCODE

CVE-2024-3094 is a critical supply chain security vulnerability discovered in the widely used XZ Utils data compression library, specifically affecting

The mlab-sh/mlab-cli repository provides a command-line interface for interacting with threat intelligence and CVE APIs, functioning as a vital link

CVE-2026-49366 is a critical command injection vulnerability impacting JetBrains IntelliJ IDEA versions prior to 2026.1.1. The core flaw resides within

CVE-2026-105306 represents a critical security flaw located within the Dynamic Client Registration flow of Keycloak. The mechanism is designed to

The vulnerability stems from uncontrolled resource consumption during XML parsing, specifically classified under CWE-400 for resource exhaustion and denial of

CVE-2024-3400 represents a critical command injection vulnerability in Palo Alto Networks PAN-OS. It specifically targets the GlobalProtect feature configured as

The rescore application exhibits a critical remote code execution vulnerability originating from improper handling of dynamic input passed directly into

CVE-2024-23897 is a critical security vulnerability discovered in the Jenkins automation server command-line interface. The flaw specifically affects how command-line

Apache Log4j2 versions ranging from 2.0 up to 2.14.1 are vulnerable to critical remote code execution flaws via the Java

Apache Log4j CVE-2021-44228 is a critical zero-day vulnerability affecting Java-based logging frameworks. The vulnerability resides in Log4j’s message lookup substitution

CVE-2022-31199 is a critical remote code execution vulnerability located within the User Activity Video Recording (UAVRServer) component of Netwrix Auditor.

CVE-2026-3854 represents a critical remote code execution vulnerability located within GitHub’s internal git push and proxy infrastructure. The flaw specifically

CVE-2021-36260 is a critical remote code execution vulnerability. It affects the web server component of Hikvision devices. The flaw originates

CVE-2024-4422 is a vulnerability involving the incorrect validation of Package URL (purl) identifiers within the CVE Binary Tool. The flaw

CVE-2026-47410 represents a critical security flaw located within the core authentication architecture of the PraisonAI Platform. The vulnerability specifically impacts

CVE-2026-7936 is a vulnerability in EchelonGraph MCP versions prior to 2.7.0 involving improper handling of rejected CVE identifiers within vendor

Tabby (formerly Terminus) is a highly configurable, modern terminal emulator built for operators and developers who require extensive customization. In

CVE-2024-27980 is a high-severity security vulnerability affecting the Node.js runtime environment on Windows operating systems. The vulnerability arises from the

Signal Desktop stores files locally. Files are saved in clear text. No encryption protects local files. Chat attachments reside in

CVE-2026-21509 represents a severe remote code execution vulnerability discovered within enterprise application logic handling untrusted inputs. The flaw originates from

CVE-2021-44228, widely known as Log4Shell, is a critical zero-day vulnerability affecting Apache Log4j versions 2.0 through 2.14.1. The vulnerability arises

CVE-2026-42007 represents a critical security flaw located within the Dovecot mail server architecture. The vulnerability specifically affects implementations utilizing the

CVE-2026-6875 represents a critical security flaw residing within the ServiceNow AI Platform, allowing unauthenticated attackers to achieve remote code execution

Apache Log4j2 is a widely utilized Java-based logging library incorporated into countless enterprise applications, cloud services, and consumer software products

Supply chain vulnerabilities arise when modern software pipelines ingest third-party dependencies, packages, and container images without comprehensive verification, leaving systems

CVE-2026-0756 is a critical remote code execution vulnerability affecting the GitHub Kanban Model Context Protocol server. The flaw exists due

GhostLM introduces comprehensive code security analysis capabilities designed to evaluate software vulnerabilities across multiple programming languages and frameworks. The framework

Next.js Server-Side Rendering infrastructure introduces complex execution paths that mishandle untrusted input during client-server transitions. When applications process dynamic rendering

CVE-2026-13001 is a critical-severity vulnerability affecting the Podlove Podcast Publisher plugin for WordPress in versions 4.5.1 and below. The flaw

CVE-2026-85706 represents a critical path traversal vulnerability discovered within self-managed GitLab instances. Specifically residing within the repository commits API endpoint,

CVE-2021-21974 is a critical heap-overflow vulnerability that impacts the OpenSLP service in VMware ESXi. The flaw specifically resides within the

CVE-2019-0190 represents a critical logic and resource management flaw residing in the way the Apache HTTP Server’s mod_ssl module handles

CVE-2011-4116 represents a classic security vulnerability residing within the File::Temp module and file handling mechanisms of the Perl ecosystem, specifically

CVE-2024-58259 is a critical high-severity vulnerability impacting SUSE Rancher Manager resulting from improper resource allocation and a complete absence of

The vulnerability lies within the way Contao CMS handles search indexing and authorization filtering for protected pages through the `ModuleSearch`

Vikunja handles task ordering and kanban organization through a shared task_positions table that maps tasks to project views using composite

The vulnerability stems from how the TinaCMS admin interface constructs its preview iframe source using the router splat parameter without

A project member with Write permission can delete an admin-tier link share on that project due to an authorization bypass

The vulnerability identified as cross-site scripting in the Contao comments bundle represents a severe security flaw affecting unauthenticated frontend user

The vulnerability identified as CVE-2026-91969 affects the v2 CSV migration route within the application backend. Specifically, the endpoint `POST /api/v2/migration/csv/migrate`

The vulnerability exists in Vikunja version 2.6.0 where server-side session revocation semantics fail to cover the WebSocket boundary entirely. When

The vulnerability resides in the CalDAV storage provider route handler of Vikunja, specifically within the task relation persistence logic. When

Vikunja ships with default CORS settings where `cors.origins` defaults to localhost wildcards and `Access-Control-Allow-Credentials` is set to true. When a

The security vulnerability identified in Contao involves a critical flaw within the ModuleRegistration component. Specifically, the ModuleRegistration::compile() method processes incoming

The vulnerability resides within the rich-text parsing and rendering mechanism of the TinaCMS web components package. Specifically, the component processes

A path traversal vulnerability exists within the bookmark-restore functionality of the Shiny for Python framework. When a client interacts with

Due to a caching defect in Contao’s security voter that governs table-level access to the Data Container backend, a low-privileged

The vulnerability arises due to improper input sanitization and a missing boundary check within the application’s image processing logic. Specifically,

In Nginx UI versions 2.5.0 through 2.5.x, a security flaw exists within the node-signature authentication path where incoming request bodies

In Vikunja v2.6.0, the project permission engine evaluates a user’s effective permissions across a tree structure using a recursive Common

CVE-2026-91970 is a critical resource exhaustion vulnerability located in the Planka migration module of Vikunja. The vulnerability arises because the

CVE-2026-33634 represents a critical supply-chain compromise affecting the Aqua Security Trivy ecosystem. Threat actors leveraged compromised release credentials to infiltrate

The vulnerability stems from improper handling of user-controlled input within the TinaCMS CLI package. Specifically, during the build or code

The vulnerability resides in the revocation handling paths of Vikunja projects, specifically concerning webhooks and link shares created by project

A critical logic flaw exists within the authentication context handling of Vikunja’s API and OAuth subsystems. Specifically, a scoped API

CVE-2024-0204 represents a severe authentication bypass vulnerability. It impacts the Fortra GoAnywhere Managed File Transfer application. The flaw resides in

The Apache Log4j vulnerability, commonly known as Log4Shell, represents a critical flaw in Java logging. It involves improper validation of

CVE-2019-18935 is a critical vulnerability impacting Progress Telerik UI for ASP.NET AJAX. It affects versions spanning from 2011.1.315 up to

pyLoad includes the WindowsPhoneNotify plugin addon, which features a send method that initializes an HTTP connection using parameters configured directly

The vulnerability arises because the hardening added via `UnTar._safe_extractall` for GHSA-mvwx-582f-56r7 strictly validates member names and symlink or hardlink targets,

CVE-2026-107810 affects Nginx UI prior to version 2.5.0 by introducing a critical flaw in the backup and restore mechanism. An

An incomplete fix for the previous secure-session requirement leaves sensitive cluster mutation endpoints unprotected. Specifically, the secure-session or OTP step-up

The Nginx-UI self-upgrade mechanism enables administrators to update the application directly through its web interface or API. During this workflow,

This security vulnerability arises due to an architectural flaw in pyLoad’s API permission revocation mechanism, specifically involving cookie-based Flask sessions.

The vulnerability arises due to flawed permission evaluation logic in pyLoad’s API layer, specifically involving the `Perms.ANY` decorator flag. Because

CVE-2026-107808 represents a critical authentication and authorization design flaw residing within the Nginx UI management platform, specifically impacting second-factor authentication

The vulnerability stems from a trust-boundary failure between browser-managed cookies and API bearer-token authentication within the Nginx-UI application architecture. Specifically,

pyLoad contains a security vulnerability in its Web UI request-handling components where client-IP derivation relies unsafely on the client-supplied X-Forwarded-For

Nginx-UI contains a high-severity trust-boundary failure between ordinary authenticated users and cluster node credentials. The source code reveals that cluster

This security vulnerability stems from improper privilege management and session handling logic within the pyLoad-ng application interface. Specifically, when an

The vulnerability resides in the way Nginx-UI handles its master node secret mechanism, allowing it to be supplied via URL

CVE-2024-27297 represents a severe security vulnerability within the Nix package manager and multi-user NixOS environments where unprivileged users can submit

CVE-2026-55797 is a high-severity command injection vulnerability affecting the Argo CD repo-server. It stems from how Argo CD processes SOCKS5,

The vulnerability resides within the `check_apikey()` function inside pyLoad’s web user interface helpers and API core components, which handles API

The vulnerability known as CVE-2026-45018 affects MCP integrations within server environments by failing to properly validate user-supplied command strings. Specifically,

The vulnerability resides within the pyload-ng application’s web user interface blueprint file. Specifically, the endpoint route responsible for rendering templates

The vulnerability resides within the application programming interface blueprint implementation of the pyLoad download manager application. Specifically, the multipart file

CVE-2026-63030 represents a critical security vulnerability affecting WordPress Core. The flaw resides specifically within the REST API batch processor endpoint.

Capacitor is a cross-platform native runtime designed for web applications. It bridges web code with native mobile capabilities on iOS

The vulnerability exists within the permission handling implementation of Strawberry GraphQL, specifically inside the PermissionExtension.resolve() method. When a GraphQL field

Strawberry GraphQL legacy graphql-ws subscription handler retains task bookkeeping. Completed one-shot subscriptions leave state in self.tasks. The natural completion path

Apache Log4j2 is a widely utilized Java logging library integrated into countless enterprise software solutions and cloud services globally. The

The vulnerability designated as CVE-2025-49596 represents a critical security flaw within the Model Context Protocol (MCP) Inspector architecture, transforming a

The Apache Log4j vulnerability, widely designated as Log4Shell, represents a critical security flaw impacting Java applications globally. It originates from

CVE-2025-39789 is a security vulnerability identified within the Linux kernel’s cryptographic subsystem, specifically affecting the x86 AEGIS implementation. The issue

CVE-2025-48384 is a critical security vulnerability discovered in the Git version control system that affects multiple non-Windows client installations across

In the initial pre-release phase of software development, repositories often distribute raw compiled binaries directly without cryptographic guarantees. Without cryptographic

CVE-2021-44228, commonly known as LogShell, is a critical remote code execution vulnerability affecting the Apache Log4j logging library. The flaw

CVE-2025-52888 represents a severe XML External Entity (XXE) vulnerability residing within the xunit-xml-plugin component of Allure Report. The security flaw

The heretix-cli utility suffers from an authentication and configuration flaw wherein earlier versions permitted execution without upfront API keys, defaulting

An authorization vulnerability exists within the ARL-Next platform affecting the GitHub threat monitoring endpoints. In versions prior to v1.4.0, specific

Software supply chain security relies heavily on automated vulnerability scanning tools. Heretix management serves as a centralized dashboard for tracking

The provided repository context highlights the `hideouts-io/MacScope` project on GitHub, specifically pointing to the absence of published releases. When an

Hazelcast Platform suffers from an authorization bypass flaw located within its IMap Predicates API. The vulnerability stems from missing authorization

Start with technical + CVE id format: (Platform name), Vulnerability type, CVE(id) (and if low or medium or critical). Example

The vulnerability stems from how the fast-jwt library computes expiration cache deadlines within the verification module. Specifically, the cache-setting logic

CVE-2024-45519 is a severe remote code execution vulnerability discovered in the postjournal service of the Zimbra Collaboration Suite. The flaw

This vulnerability arises because Indico handles outgoing HTTP requests to external URLs provided by users as part of its regular

An authorization bypass vulnerability exists within the praisonai-platform API routes for handling shared labels and issue-label associations. Specifically, ordinary workspace

CVE-2025-30144 is a critical logical vulnerability residing in the JavaScript JSON Web Token (JWT) library fast-jwt, specifically within its decoder