Author name: UNDERCODE

The vulnerability arises when applications deserialize untrusted pickle data without proper safeguards. Attackers can craft pickle payloads that instantiate standard

This vulnerability exploits a misalignment between the Keycloak Admin REST API’s `/unmanagedAttributes` endpoint and the configurable User Profile. An administrator

SandboxJS implements prototype chain validation in `executor.ts` LispType.Prop operation (lines 368-398). It correctly restricts access to the root Object.prototype. However,

The vulnerability exists in the `DefaultConfig()` function within internal/conf/config.go, where the `TlsInsecureSkipVerify` parameter is set to `true` by default. This

The vulnerability stems from an insecure sudoers configuration recommended in SSH documentation for Proxmox VE systems integrating Terraform. A suggested

The vulnerability exists in the `use_hint` function within the ML-DSA reference implementation’s hint.rs. FIPS 204 Algorithm 40 specifies distinct operations

The CVE-2024-28157 vulnerability exploits the TechDocs plugin in Backstage when configured to run documentation builds locally (runIn: local). An attacker

The vulnerability in OpenTelemetry Go SDK versions 1.21.0 to 1.39.0 on macOS/Darwin systems allows arbitrary code execution via PATH hijacking.

The vulnerability exists within the `FsRemove` and `FsCopy` file operation handlers in server/handles/fsmanage.go. The application takes user-supplied filenames from the

The vulnerability exploits the `addMetadata` function in jsPDF, where the first argument is user-controlled and unsanitized, allowing arbitrary XML injection

The vulnerability exploits insufficient input sanitization in the Acroform module of jsPDF, allowing attackers to inject arbitrary PDF objects through

The vulnerability exists within the `addImage` and `html` methods of the jsPDF library. When processing a BMP image, the library

The vulnerability exists in the `set-system-time` plugin for the Signal K marine data server. When the plugin is enabled, it

The vulnerability exists in the `addJS` method of the jsPDF library in its Node.js build. A module-scoped variable named `text`

The vulnerability is a classic stored XSS where user-supplied input is not properly sanitized before being rendered. Specifically, malicious JavaScript

The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in FacturaScripts. It occurs when user-supplied input passed in the `code`

The vulnerability chain in vLLM (<0.14.1) enables pre-auth Remote Code Execution (RCE) when processing a malicious video URL. The attack

The vulnerability is an Insecure Direct Object Reference (IDOR) within Khoj’s Notion OAuth callback endpoint (/notion/auth/callback). The endpoint uses a

This vulnerability occurs in the TechDocs local generator (techdocs.generator.runIn: local) of the Backstage software catalog. When building documentation from untrusted

The vulnerability in Salt’s junos execution module arises from the use of unsafe YAML deserialization functions, specifically `yaml.load()` from the

The SQL injection vulnerability in geopandas’ to_postgis() function arises due to insufficient input sanitization when constructing SQL queries for writing

The vulnerability in Salt stems from an authentication protocol version downgrade weakness. Salt uses a protocol for minions to authenticate

The vulnerability in Rancher Manager involves a flaw in the Rancher CLI login command when self-signed CA certificates are used.

The CVE-2026-23835 vulnerability in LobeChat stems from inadequate server-side validation of client-supplied parameters during file uploads. When a user uploads

PsySH, a PHP runtime developer console, automatically loads and executes a `.psysh.php` configuration file from the shell’s Current Working Directory

This CVE exploits an incomplete sanitization fix in OpenAPI Generator’s `jsStringEscape` function. The function correctly escapes quotes but fails to

How the Mentioned CVE Works: The vulnerability exists in the initialization routine of Llama Stack when integrating with a pgvector

The vulnerability exists in the numeric entity parsing logic of the fast-xml-parser library. In the `OrderedObjParser.js` file, the regular expressions

The vulnerability exists in the `NativeAuthenticationStrategy.authenticate()` method. When a login request is made, the method first queries the database to

The vulnerability exists within the file export API endpoint (/umbraco/forms/api/v1/export). An authenticated user with backoffice access can submit export requests.

The vulnerability in deephas npm package version 1.0.7 stems from insecure validation in the `add()` and `indexer()` functions within deepHas.js.

The vulnerability exists in malcontent’s integration with the `google/go-containerregistry` library for pulling OCI images. By default, this library uses the

The vulnerability resides in the `handleSymlink` function within the archive extraction logic. When processing a symbolic link entry from a

How the mentioned CVE works: The vulnerability, dubbed “Log4Shell,” exists in the Java Naming and Directory Interface (JNDI) lookup feature

The command injection vulnerability in the browserstack-local Node.js package version 1.5.8 originates from improper sanitization of the logfile variable in

How the Vulnerability Works The vulnerability exists in how the Unfurl web application processes its debug configuration. The `web_app()` function

The vulnerability exists in the `unfurl/parsers/parse_compressed.py` file. When processing compressed data embedded in URLs, the function `zlib.decompress(decoded)` is called without

The CVE-2024-34068 vulnerability in SiYuan arises from improper path validation in the `/api/file/copyFile` endpoint. In the `copyFile` function within kernel/api/file.go,

This vulnerability exists in Juju’s cross-model relation authorization logic when handling macaroons. When a controller receives a macaroon for authorization

The CVE-2024-42550 vulnerability involves prototype pollution in the maker.js library’s extendObject function. This function copies properties from source objects to

The vulnerability exists in two block execution endpoints (/api/blocks/{block_id}/execute and /external-api/v1/blocks/{id}/execute). These endpoints correctly require user authentication but fail to

The vulnerability stems from incomplete patches for prior Denial of Service (DoS) flaws within React Server Components (RSC). Attackers can

The vulnerability resides in the `/api/file/getFile` endpoint, which employs case-sensitive string equality checks to prevent access to sensitive files such

The vulnerability in billboard.js stems from inadequate input sanitization during the chart option binding process. When user-controlled data is passed

This vulnerability arises when the Bytes::slice, Vec::slice, and `Prng::gen_range` (for u64) methods in the Soroban SDK (v25.0.1 and prior) perform

The vulnerability exists within Symfony’s Process component for Windows when PHP is executed from an MSYS2 shell like Git Bash.

How the CVE Works: This Cross-Site Scripting (XSS) vulnerability exists within the DotNetNuke (DNN) platform’s module management. The affected `DotNetNuke.Core`

The vulnerability exists due to improper handling of SVG file attachments. In attachmentHelpers.ts, a previewable MIME type check uses `mimetype.includes(type)`

The vulnerability is an open redirect in NocoDB’s authentication flow. It stems from inadequate validation of the user-controlled `continueAfterSignIn` query

How the mentioned CVE works: The vulnerability exploits prototype pollution in NocoDB’s deepMerge function within dataUtils.ts. This function recursively merges

The vulnerability occurs in the `uploadViaURL` function when processing a user-supplied URL. Before downloading a file, the function uses `axios.head()`

The vulnerability exploits a PHP type juggling issue in EGroupware’s Nextmatch widget filter processing. Authenticated users can send JSON payloads

The vulnerability in vlt (before version 1.0.0-rc.10) stems from insufficient sanitization of file paths within tar archive entries during the

The vulnerability exists in the `monotonic` helper function within the `ml-dsa/src/hint.rs` file of the RustCrypto ML-DSA implementation. This function is

The vulnerability is a DOM-based Cross-Site Scripting (XSS) within the Ghost Portal membership component. The attack vector is a specifically

The vulnerability exists in the `node-tar` library within lib/unpack.js. When extracting a hardlink entry, the security validation logic and the

The vulnerability (CVE-2026-XXXXX) is a protocol compliance flaw within the Clatter library’s implementation of the Noise Protocol Framework. It incorrectly

This vulnerability, CVE-2024-2173, exists within the module management interface of DNN Platform (formerly DotNetNuke). The ‘Friendly Name’ property of an

The vulnerability exists in the `mulDiv(x, y, z)` function for signed integer types (i64, i128, I256). When both the intermediate

The CVE-2024-3273 vulnerability exploits a Cross-Site Scripting (XSS) flaw in the ErrorBoundary component of the hono/jsx library. Specifically, the component

The Server-Side Request Forgery (SSRF) vulnerability in vLLM’s MediaConnector class stems from inconsistent URL parsing between validation and request execution.

The vulnerability (CVE-2025-XXXXX) resides within the DotNetNuke.Core Scheduler logging functionality. Attackers with permission to create or manage scheduled tasks (typically

The CVE-2024-34093 vulnerability in Cap’n Proto Rust arises from safe API functions that internally rely on unchecked operations, leading to

The vulnerability exists within the `ContentPane.InjectHeaderFooter` method of the DotNetNuke (DNN) platform. This method is responsible for injecting user-supplied header

This vulnerability exists within the `NoCloseOutputStream.java` class of the jsonrpc4j library. When processing specific RPC stream responses, the `write` method

The vulnerability is an improper verification of cryptographic signature in the SeekableOutputStream.Java file within the batik-codec-fix module of the quick-media

The vulnerability involves improper control of sequential memory allocation in the weixin4j library, specifically within the CharArrayBuffer.Java and ClassUtil.Java files

The vulnerability exists within the `PNGImageEncoder` class of the Batik Codec FIX module (plugins/svg-plugin/batik-codec-fix). The code fails to properly sanitize

This vulnerability exists within the React Server Components (RSC) payload deserialization mechanism used by Next.js App Router Server Functions (Server

How the CVE works: This vulnerability affects Next.js applications with Experimental Partial Prerendering (PPR) enabled and running in minimal mode

The vulnerability resides in the `cleanupForCoverage()` method of the PHPT test runner. When PHPUnit executes a PHPT test with code

The vulnerability resides in flawed fallback logic for token authentication on specific API endpoints (GetConfig() and RefreshResource). For most endpoints,

The vulnerability exploits a missing authorization check on a specific endpoint (/dashboard/content-management/edit). While the endpoint verifies a user is authenticated

The vulnerability is an authentication bypass in the FortiCloud SSO authentication mechanism. When enabled, the system fails to properly validate

A vulnerability exists in the KubeVirt guest agent (virt-launcher) where its mechanism for reporting guest information, specifically network interfaces, lacks

The vulnerability in Hibernate Reactive stems from inadequate handling of database connection lifecycle during premature HTTP connection closures. When an

The vulnerability is a classic reflected DOM-based Cross-Site Scripting (XSS) in the GI-DocGen documentation tool. It occurs because user input

The vulnerability exists within the `mapstructure.WeakDecode()` function’s error handling mechanism. When processing user-supplied data, such as JSON payloads destined for

The vulnerability resides in PyTorch’s `weights_only=True` unpickler, designed to safely load only model tensors from `.pth` checkpoint files. The security

The vulnerability is a sandbox escape leading to Remote Code Execution in the `@nyariv/sandboxjs` library. The library’s security model relies

How the CVE Works: The vulnerability resides in the Image Optimization API (/_next/image) of self-hosted Next.js applications. When the `remotePatterns`

The vulnerability resides in the path resolution logic of the Serve Static Middleware configured for the Cloudflare Workers adapter. When

The vulnerability exists within the caching logic of the `@hono/cache` middleware (specifically the `httpCache` function). When processing an HTTP response,

The vulnerability exploits flaws in Hono’s IP address parsing to bypass restriction middleware. The `IPV4_REGEX` pattern `/^[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}$/` accepts octet strings

The vulnerability exists in the API key validation mechanism of OctoPrint. The system uses a standard string comparison that checks

This vulnerability exploits Kyverno’s JMESPath expression engine, specifically the `random()` and `join()` functions, to cause exponential memory growth. An attacker

The vulnerability exploits Kyverno’s apiCall context variable substitution. When a namespaced Policy is evaluated, user-controlled variables are inserted into the

The vulnerability exists within the `ReadFile()` function of the gmrtd library, which processes BER-TLV encoded data from NFC/APDU sources via

When a `oneshot::Receiver` future is polled, it transitions the internal channel state to `RECEIVING` and stores a waker on the

The vulnerability exists in Dozzle’s agent-backed shell endpoints (/api/hosts/{hostId}/containers/{containerId}/exec and /attach). When using SIMPLE authentication with per-user label filters (e.g.,

The vulnerability in pypdf occurs during the parsing of PDF outlines or bookmarks. When the library accesses these elements, it

The vulnerability occurs in the Log Socket Collector of Apache Karaf Decanter. This collector listens on port 4560 without authentication.

The vulnerability in Apache Continuum involves improper neutralization of special elements in the Installations REST API, leading to command injection.

The vulnerability exists in the `initTUFClients()` function within multirepo.go. When initializing a multi-repository TUF client, the code constructs a local

The vulnerability resides within the native client library of Apache Hadoop HDFS. An out-of-bounds write occurs when the software, while

How the Mentioned CVE Works: CVE-2026-24470 is a security misconfiguration in Skipper Ingress Controller versions prior to v0.24.0. The vulnerability

This vulnerability exploits the behavior of Python’s `os.path.join()` function within Flask-AppBuilder’s file upload logic. When the non-default configuration options `UPLOAD_DIR`

This vulnerability operates through improper validation of user-supplied input within HTTP header values and names. The Gakido client library failed

The reflected Cross-Site Scripting (XSS) vulnerability exists in the GET /admin/edit-codepage/:name route where the ‘name’ parameter is directly inserted into

How the CVE Works pnpm’s package installation process handles executable binaries defined in a package’s `directories.bin` field. The vulnerable code