Author name: UNDERCODE

The vulnerability resides in Active Support’s number helper methods (e.g., number_to_human, number_to_currency, number_to_delimited). These helpers accept numeric input as strings

The vulnerability arises from an improper propagation of the `@html_unsafe` flag within the `SafeBuffer%` method in Rails Active Support. A

The vulnerability resides in the discourse-policy plugin, a component that allows administrators to define automated policies based on user actions.

How the CVE Works This vulnerability exists within the Zimbra Collaboration Suite (ZCS) Classic UI due to improper sanitization of

The vulnerability resides in the Code Study Plugin of Connect-CMS, where an authenticated user can trigger arbitrary code execution. The

The vulnerability stems from an unauthenticated endpoint within the AVideo API plugin. Specifically, the file `plugin/API/get.json.php` is accessible without any

The vulnerability arises from a flawed matching routine in the webpki crate when a certificate contains multiple CRL distribution points.

The vulnerability arises when Indico is configured to use server‑side LaTeX rendering (i.e., `XELATEX_PATH` is set in indico.conf). Indico attempts

The vulnerability resides in AVideo’s API endpoint APIName=locale, which is exposed without authentication. The file `plugin/API/get.json.php` sets `$global[‘bypassSameDomainCheck’] = 1`

The vulnerability resides in the `listFiles.json.php` endpoint of WWBN AVideo versions prior to 26.0. An authenticated user with uploader privileges

How the mentioned vulnerability works: The Cabinet Plugin in Connect-CMS provides a list view that displays file and folder names.

How the CVE works The Sprig Playground is a development tool bundled with the Sprig plugin for Craft CMS. It

The vulnerability arises from a flaw in Craft CMS’s input handling that allows an unauthenticated attacker to trigger arbitrary PHP

The vulnerability resides in the way libde265, an open-source H.265 decoder, handles a malformed Picture Parameter Set (PPS) NAL unit.

How the mentioned CVE works: The vulnerability resides in OpenClaw versions before 2026.2.26, specifically within the system event handlers for

The vulnerability exists in OpenWrt’s hotplug_call function, which is part of the procd process manager. The function is responsible for

The vulnerability in CVE-2026-32896 resides in the webhook handler of the BlueBubbles plugin for OpenClaw versions prior to 2026.2.21. The

How CVE-2026-33550 works The vulnerability resides in SOGo’s handling of one‑time passwords (OTP) when a user toggles their two‑factor authentication

How the mentioned CVE works The vulnerability abuses the `set_config_value()` API endpoint, which is accessible to users holding the non‑admin

How the CVE Works: This vulnerability resides in the `discourse-policy` plugin. Under normal circumstances, only users belonging to specific “policy

The vulnerability stems from improper lock state checking in the shared memory subsystem of Apple’s XNU kernel and its inter‑process

The vulnerability resides in Active Storage’s `DiskServicepath_for` method. This method constructs a filesystem path by appending a blob key to

How the mentioned CVE works: In NestJS versions 11.1.15 and below, when using the Fastify adapter (@nestjs/platform-fastify), HTTP `HEAD` requests

How the CVE Works The vulnerability exists within the Form Plugin component of Connect CMS. When an administrator creates or

The vulnerability in Livewire v3 up to v3.6.3 stems from insecure hydration of component property updates. When a Livewire component

The vulnerability stems from insecure deserialization of Java objects in the web‑based management interface of Cisco Secure Firewall Management Center

How the mentioned CVE works: The vulnerability resides in the SOAP API authentication mechanism when MantisBT is paired with a

The vulnerability exists in SOGo, an open-source groupware server, affecting versions prior to 5.12.5. It is a stored Cross-Site Scripting

The vulnerability stems from a missing ownership check in the My Page profile update endpoint. When an authenticated user submits

The vulnerability stems from a memory corruption flaw in the XNU kernel’s memory mapping subsystem, specifically within the `mach_vm_remap` functionality.

CVE-2026-23233 is a logical flaw in the Linux kernel’s F2FS (Flash-Friendly File System) discovered by Xiaolong Guo. The vulnerability resides

The vulnerability resides in the Community Tier of Harden-Runner, a GitHub Actions security tool, where egress-policy: block mode fails to

The vulnerability resides in the `classmate-laptop` driver for x86 platforms. Due to improper initialization ordering, sysfs attributes related to the

The vulnerability, assigned CVE-2026-30939, resides in how Parse Server resolves Cloud Function names. When a request is made to a

The vulnerability resides in the `hp-bioscfg` driver, which is responsible for managing HP BIOS configuration settings via the Windows Management

The vulnerability exists in the LiveLinks plugin’s proxy.php endpoint, which validates user-supplied URLs using isSSRFSafeURL() but only checks the initial

CVE-2026-3909 is a high-severity vulnerability in Google Chrome’s Skia 2D graphics library, existing in versions prior to 146.0.7680.75 . Skia

In the Linux kernel, a vulnerability exists in the ath10k WiFi driver’s handling of DMA (Direct Memory Access) memory. The

The vulnerability, identified as CVE-2025-30162, is an Incorrect Authorization issue (CWE-863) found in Cilium, an eBPF-based networking and security solution

The vulnerability resides in the F2FS filesystem’s sysfs interface, where attributes are exposed under `/sys/fs/f2fs/` for runtime tuning. The core

The vulnerability resides in the `smscufx` framebuffer driver for SMSC UFX USB display devices. The core issue is in the

The vulnerability, CVE-2025-71202, resides in the Linux kernel’s IOMMU (Input-Output Memory Management Unit) Shared Virtual Addressing (SVA) subsystem on x86

The vulnerability in Parse Server (CVE-2026-XXXX) is a race condition in the password reset mechanism that allows a single-use token

In versions 0.5.6 and earlier of the `astral-tokio-tar` library, a critical flaw exists in how PAX extended headers are processed.

The vulnerability allows unauthenticated remote code execution (RCE) via the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint. This endpoint is designed to build public

The vulnerability exploits how the Sliver C2 server handles message framing in its mTLS and WireGuard transports. The protocol prefixes

The vulnerability arises from a buffer index miscalculation in the `tkeyclient` Go module when handling User Supplied Secrets (USS) .

A deadlock vulnerability exists in the Linux kernel’s ath12k WiFi driver due to improper locking during the flushing of management

The vulnerability lies in the file /objects/phpsessionid.json.php, which is accessible without any authentication. This endpoint is designed to return the

The vulnerability stems from a race condition in the Linux kernel’s network filesystem (netfs) layer during buffered read operations. Specifically,

How this CVE works: This vulnerability resides in Parse Server’s user signup flow . The core issue is that the

CVE-2025-71238 is a vulnerability in the Linux kernel’s `qla2xxx` SCSI driver, specifically in the `qla_bsg.c` file which handles SCSI Generic

Parse Server fails to sanitize user input during session creation via the `POST /classes/_Session` endpoint. An authenticated attacker can supply

A vulnerability in the Community Tier of Harden-Runner allows bypassing `egress-policy: block` network restrictions using DNS over TCP. Harden-Runner enforces

The vulnerability resides in the `libceph` subsystem of the Linux kernel, specifically within the OSD (Object Storage Daemon) client’s handling

The vulnerability is a memory leak in the Linux kernel’s device tree (of) unittest module. In the function unittest_data_add(), memory

In the Linux kernel, a race condition was discovered in the SMB client’s cached file descriptor (cached_fid) handling. Three status

A remote attacker can crash a Parse Server instance by subscribing to a LiveQuery with an invalid regular expression pattern.

The vulnerability CVE-2024-31819 exists in the `install/checkConfiguration.php` endpoint of AVideo (formerly YouPHPTube) versions 12.4 through 14.2 . This endpoint is

The fix for CVE-2026-26278 introduced limits like `maxTotalExpansions` and `maxExpandedLength` to block XML entity expansion DoS attacks, but these only

The vulnerability resides in the `DefaultHtmlErrorResponseBodyProvider` of the `micronaut-http-server` module. When a Micronaut application throws an exception, this provider generates

CVE-2026-23234 is a use-after-free vulnerability in the `f2fs` (Flash-Friendly File System) component of the Linux kernel, specifically within the I/O

The vulnerability exists in the `loginok.html` endpoint of Wing FTP Server versions prior to 7.4.4. It is triggered when an

The vulnerability resides in the ASF parser of music-metadata, specifically within the `parseExtensionObject()` function in `lib/asf/AsfParser.ts` (lines 112-158). When a

The vulnerability exists in the file /objects/encryptPass.json.php, which is accessible without any authentication. This endpoint accepts a user-supplied password via

Technical Explanation of CVE-2024-34899 This reflected XSS vulnerability exists in AVideo’s `videoNotFound.php` file because unsanitized user input flows directly into

The vulnerability allows an unauthenticated attacker to crash the Parse Server process by sending a single, specially crafted request containing

The vulnerability arises from a flawed patch (commit 196c81fdd438) in the Linux kernel’s F2FS (Flash-Friendly File System) filesystem, which was

CVE-2026-23238 is a vulnerability in the Linux kernel’s romfs filesystem due to a missing return value check. The romfs_fill_super() function

A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to

The vulnerability stems from a flaw in Parse Server’s request processing pipeline. The server uses a deep copy mechanism, powered

In a NestJS application using @nestjs/platform-fastify, a critical vulnerability exists where GET middleware can be bypassed due to Fastify’s automatic

CVE-2026-23132 is a vulnerability found in the Linux kernel’s Synopsys DesignWare DisplayPort (dw-dp) bridge driver. The issue resides in the

In the Linux kernel, a use-after-free vulnerability exists in the netfilter subsystem’s nf_tables chain addition process. The function `nf_tables_addchain()` publishes

CVE-2026-23134 is a vulnerability in the Linux kernel’s memory management (slab allocator) that affects systems running with the PREEMPT_RT (Real-Time)

The vulnerability arises from a flaw in how the Linux kernel’s ath12k WiFi driver manages DMA (Direct Memory Access) buffers.

Two independent bugs in Fickling’s AST-based static analysis combine to allow a malicious pickle file to execute arbitrary stdlib function

In the Linux kernel, a NULL pointer dereference vulnerability was discovered in the traffic control subsystem’s IFE (Inter-Frame Encoding) action

The vulnerability resides in the `kvaser_usb` driver for CAN interfaces. During device setup, USB Request Blocks (URBs) for incoming data

CVE-2026-23062 is a vulnerability in the Linux kernel’s `hp-bioscfg` driver, which provides a sysfs interface for managing HP BIOS configuration

The vulnerability resides in the ARM-specific IOMMU (Input-Output Memory Management Unit) page table code within the Linux kernel. The function

The vulnerability, identified as CVE-2026-31795, resides in the `CIccXform3DLut::Apply()` function within iccDEV versions prior to 2.3.1.5 . iccDEV is a

CVE-2026-31793 is a vulnerability in the iccDEV library, a toolkit for handling ICC color profiles, prior to version 2.3.1.5. The

A Cross-Site Scripting (XSS) vulnerability exists in the Angular runtime and compiler when an application uses a security-sensitive attribute (like

CVE-2026-30987 is a stack-based buffer overflow vulnerability in iccDEV, a library for handling ICC color profiles, affecting versions prior to

The vulnerability stems from a flawed conditional check in the ZIP detection logic of the `file-type` library. For inputs with

The vulnerability resides in the Feishu webhook mode of OpenClaw versions up to 2026.3.11. Feishu, a popular collaboration suite, allows

In the Linux kernel, a potential integer underflow vulnerability was identified in the vsock/virtio transport mechanism. The function `virtio_transport_get_credit()` calculates

A critical vulnerability in OpenClaw versions up to 2026.3.11 allowed an attacker to gain elevated privileges by exploiting a flaw

This CVE details a stored Cross-Site Scripting (XSS) vulnerability found in the Statamic CMS control panel, specifically within the color

CVE-2026-31792 is a vulnerability in the iccDEV library, used for handling ICC color management profiles. The issue resides in the

The vulnerability arises from improper sanitization of keys during query plan execution in the Apollo Federation gateway. When the gateway

The vulnerability is a Path Traversal issue (CWE-22) where the product uses external input to construct a pathname intended to

CVE-2026-31794 is a denial-of-service vulnerability found in iccDEV, a library for working with ICC color profiles, prior to version 2.3.1.5

The vulnerability addressed in this advisory is a critical flaw in the device pairing mechanism of OpenClaw versions up to

The vulnerability stems from an authorization mismatch within the OpenClaw gateway, specifically affecting the browser profile management routes . An

The vulnerability arises from the GitHub repository “zero-shot-scfoundation” incorporating a third-party component that contains a pre-existing security flaw. This dependency,

In the Linux kernel, a vulnerability was found in the SPI SPRD ADI driver, specifically in how it handles errors

In the Linux kernel, a memory leak vulnerability was discovered in the AMD platform driver, specifically within the `wbrf_record()` function

OpenClaw’s Zalouser component handles group-based authorization for message routing. The vulnerability, tracked as GHSA-f5mf-3r52-r83w, resides in how the allowlist mode