Author name: UNDERCODE

The CVE-2024-34499 vulnerability in LIEF arises from a null pointer dereference in the ELF binary parser. Specifically, the function `Parser::parse_binary`

Cosign verifies software artifacts using Sigstore components like Rekor, a transparency log. A Cosign bundle contains artifact signatures and a

How the Mentioned Vulnerability Works The vulnerability is a Stored Cross-Site Scripting (XSS) in HAXCMS that enables full account takeover.

The vulnerability exists in the `SecurityIO.groovy` class where data is encrypted using AES/CBC/PKCS5Padding. CBC mode alone provides confidentiality but not

This vulnerability exploits the absence of rate-limiting controls on the Shiori web application’s login endpoint. The login function does not

The vulnerability is a timing side-channel in the Decompose algorithm used during ML-DSA signing for hint generation. It stems from

The vulnerability arises from a misconfiguration in the Mailpit WebSocket server’s origin validation. In the `server/websockets/client.go` file, the `CheckOrigin` function

The vulnerability in n8n’s Webhook node stems from flawed IP whitelist validation logic that uses partial string matching rather than

The vulnerability is a JWT algorithm confusion attack. The `verifyJsonWebToken` method in `SecurityIO.groovy` (lines 244-249) decodes a provided JWT and

The vulnerability resides in the `decrypt()` function within the `sm2/src/pke/decrypting.rs` file of the SM2 public-key encryption library. This function processes

How the mentioned vulnerability works: The vulnerability exists in the `SecurityIO` class where the `encryptWithAES256` method deterministically derives the AES

The vulnerability in Jervis stems from its use of `java.util.Random()` to generate random delays intended to mitigate timing side-channel attacks

The vulnerability exists in the `SecurityIO.groovy` file of the Jervis project. When generating a hexadecimal string representation of a SHA-256

The vulnerability exists in the `SecurityIO.groovy` class where the cryptographic salt for PBKDF2 key derivation is generated incorrectly. Instead of

How the mentioned CVE works: The vulnerability is a Bleichenbacher padding oracle attack targeting the RSA encryption implementation. The Jervis

The vulnerability arises from the PutContents API in Gogs, which handles file uploads or content writing operations. When processing user-supplied

The vulnerability exists in the configuration parsing of the Weblate Localization Client (wlc). Historically, the tool allowed users to define

How the CVE Works The vulnerability is a persistent stored Cross-Site Scripting (XSS) within the `custom_hotkeys` feature. An authenticated attacker

How the CVE Works: The vulnerability exists in the Weblate command-line client (wlc). When processing a configuration file or command

The vulnerability is in the PUT handler within the file upload API (file.py). When a request is made with a

How the CVE Works: A critical vulnerability exists in the `sm2` crate’s Public Key Encryption (PKE) implementation. The root cause

The vulnerability (CVE-2024-3159) in the Fickling security analysis tool stems from its process of converting Python pickle bytecode to an

How the CVE Works This critical vulnerability exists within the `sm2` Rust crate’s Public Key Encryption (PKE) decryption logic. During

The CVE-2024-3832 vulnerability in Fickling stems from an incomplete static analysis mechanism for detecting unsafe Python module imports within pickles.

The vulnerability GHSA-5hvc-6wx8-mvv4 is a detection bypass in the Fickling security tool for Python pickle files. Fickling’s analysis failed to

A malicious pickle file uses `cProfile.run()` within its `__reduce__` method. The `cProfile.run()` function accepts and executes a string of Python

How the Mentioned CVE Works This vulnerability exists in the deterministic ECDSA signature generation within the affected Elliptic package, as

The vulnerability occurs in the `mnl::cb_run` function within the mnl Rust library, designed for Netlink message processing. Netlink facilitates kernel-user

The vulnerability is a persistent cross-site scripting (XSS) flaw in the October CMS backend configuration forms, specifically in the “Branding

CVE-2017-18349 is a deserialization vulnerability in the Fastjson library, affecting versions before 1.2.25. The issue stems from the mishandling of

The vulnerability resides in pypdf’s non-strict parsing mode when rebuilding the cross-reference table of a PDF. A PDF file’s cross-reference

The vulnerability exploits the non-strict parsing mode in pypdf when processing PDF files. A malicious PDF crafted without the mandatory

How the mentioned CVE works: The vulnerability is an authentication bypass in the `jose-swift` library. It resides in the `verify()`

The vulnerability is a command injection (CWE-78) in the WeKnora platform’s MCP service functionality. When an authenticated user creates or

This Cross-Site Scripting vulnerability in Angular’s template compiler stems from an incomplete security context classification within its internal sanitizer. The

The enhancement addresses a scenario where an actor with control over the application’s runtime environment could inject an invalid value,

The vulnerability in XWiki Full Calendar Macro stems from the Calendar.JSONService page, which is exposed to users with view rights,

The SQL injection vulnerability in XWiki Full Calendar Macro stems from improper input sanitization in the Calendar.JSONService page. This service

The vulnerability occurs in the October CMS backend configuration forms, specifically in the Editor Settings Markup Styles section. A user

The vulnerability is a SQL injection flaw in the `/ghost/api/admin/members/events` Admin API endpoint of Ghost. It allows authenticated users with

The vulnerability occurs when the AWS SDK for Swift constructs endpoint URLs for service calls without validating the format of

How the Mentioned CVE Works The vulnerability exists in Ghost’s “External Media Inliner” feature. When a staff user with a

The described issue is a defense-in-depth enhancement, not a formal CVE. In the AWS SDK for JavaScript v3, the client

How the Mentioned Issue Works An attacker with access to the application’s runtime environment can manipulate the ‘region’ parameter passed

The issue involves the AWS SDK for Rust’s handling of the region input field when constructing endpoint URLs for AWS

How the Mentioned CVE Works: The vulnerability exists in the `FrameworkIntegration` class when a shared cache (like Redis or Memcached)

The vulnerability is an unauthenticated Insecure Direct Object Reference (IDOR) in the Spree Commerce platform, specifically within the spree_storefront gem.

The vulnerability exists in the `list_html` function of the directory listing feature. This function generates HTML links for files and

The vulnerability occurs in React Router’s Server-Side Rendering (SSR) when using Framework Mode with the “ component. Specifically, when the

The vulnerability in Keycloak stems from an incorrect sequence of operations when handling the Authorization header in HTTP requests. According

This vulnerability exists in React Router’s Framework Mode and its experimental React Server Components (RSC) mode when handling server-side route

The vulnerability in the wolfSSL Python package (wolfssl-py) arises from incorrect handling of the verify_mode parameter when set to CERT_REQUIRED.

The vulnerability exists within the `list_html` function of the static file directory handler. When generating an HTML page to list

How the Mentioned CVE Works This vulnerability exists in the path processing logic of React Router’s navigation functions (navigate(), <Link>,

How the CVE Works This vulnerability is an Authenticated Insecure Direct Object Reference (IDOR) in the order update endpoint. The

The vulnerability exists in the `serviceLfsLocksDelete` function within pkg/web/git_lfs.go. When an authenticated user sends a DELETE request to the LFS

The vulnerability exists within the `createFileSessionStorage()` function provided by `@react-router/node` (and analogous packages in Remix v2). This function manages session

How the Vulnerability Works: The vulnerability stems from Shakapacker’s (formerly Webpacker) default webpack configuration, which used new webpack.EnvironmentPlugin(process.env). This plugin

How the mentioned CVE works: In React Router and Remix v1/v2 applications using Framework Mode, Data Mode, or unstable RSC

The vulnerability exists in the Table Object Handler component of the bluelabsio records-mover library versions up to 1.5.4. An attacker

The vulnerability resides in the ImportIam admin API endpoint within RustFS’s IAM module. Authorization is incorrectly implemented by validating permissions

The vulnerability occurs in the client disconnect sequence. When a browser tab disconnects, the `handle_disconnect()` method clears the client’s `tab_id`

How the mentioned CVE works: The vulnerability exists within React Router’s `meta()` and “ Framework Mode APIs during Server-Side Rendering

The vulnerability exploits a missing permission check in Kirby’s backend API for operations on the ‘changes version’ – a draft

The vulnerability arises from a flawed `deny_only` short-circuit logic in the RustFS IAM policy evaluation. During service account creation, if

This vulnerability exploits the lack of resource-limiting controls in CoreDNS’s gRPC, HTTPS, and HTTP/3 server implementations. For the gRPC, HTTPS,

The vulnerability is an unsafe JavaScript execution within the `_scroll_to_fragment` method. When a user navigates or when the `pushstate` event

The vulnerability occurs when attacker-controlled input is passed directly to the `ui.navigate.history.push()` or `replace()` functions. These functions are wrappers for

This vulnerability is a DOM-based Cross-Site Scripting (XSS) in NiceGUI’s `ui.sub_pages` component. It stems from unsafe JavaScript execution when handling

The safe_join function in Werkzeug is intended to securely join path segments to prevent directory traversal attacks. However, on Windows

The vulnerability occurs in Bio-Formats versions up to and including 8.3.0, where the loci.formats.Memoizer class handles memoization cache files with

The XXE vulnerability in Bio-Formats arises from insecure XML parsing in the Leica Microsystems metadata component, specifically for XLEF files.

The vulnerability exploits unsafe deserialization of pickle data in Python applications. Pickle allows arbitrary code execution during deserialization via the

The vulnerability exists in the `safePath` and `isPathAllowed` functions of version 3.4.0, which utilize Node.js `path.resolve()` for validation. The `path.resolve()`

How the mentioned CVE works: The vulnerability exists within the `execute_command` function of terminal-controller-mcp version 0.1.7. The function improperly concatenates

The vulnerability (CVE-2026-XXXX) stems from Undertow’s failure to adequately parse and validate the contents of the HTTP `Host` header. Normally,

The vulnerability arises from a soundness issue in the `IterMut` iterator implementation within an affected Rust crate. When `IterMut::next` or

How the CVE Works: The vulnerability exists in the Microsoft Playwright Model Context Protocol (MCP) server. The server fails to

A regression in Preact versions 10.26.5 through 10.28.1 softened its JSON serialization protection. This protection normally prevents Virtual DOM elements

The vulnerability exists in the `lib/input.js` file within the Formatter Handler component. It arises from improper sanitization of user input

The vulnerability is a blind SQL injection in the CoreShop e-commerce platform, specifically in the sales report functionality accessible to

The vulnerability exists within the HTTP middleware’s authentication whitelist logic. It fails to correctly normalize and compare URL paths, allowing

The vulnerability in loggingredactor occurs when the library processes log entries containing non-string data types (like integers, dicts) with format

How the mentioned CVE works: The vulnerability is a Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in

The vulnerability exists in the media proxy endpoint (GET /proxy/{encodedDigest}/{encodedURL}) within internal/ui/proxy.go. When an authenticated user subscribes to a feed

The vulnerability exists in the interaction between urllib3’s streaming API (preload_content=False) and HTTP redirect responses. The library’s design efficiently handles

The vulnerability exists in n8n’s webhook and form trigger nodes. When a workflow is triggered via a public form or

The Stripe Trigger node in n8n creates a webhook endpoint with a stored Stripe signing secret for verification. The vulnerability

This vulnerability stems from pnpm’s handling of dependencies fetched via HTTP/HTTPS tarball URLs and Git-hosted tarballs. When resolving such dependencies,

In pnpm v10+, a security feature was introduced to disable lifecycle scripts (like postinstall) for dependencies by default. This is

The vulnerability exploits the interaction between pnpm’s environment variable substitution in `.npmrc` files and the insecure execution of the tokenHelper.

A vulnerability exists in the gRPC implementation of RustFS where the `GetMetrics` endpoint handler lacks proper deserialization error handling. The

The vulnerability exists within the parsing of the `OutlineTextRefAtom` record in PowerPoint (PPT) files. This atom stores a reference index

The remote code execution vulnerability in HPE OneView stems from improper deserialization of untrusted data within its web management interface.

The vulnerability exists in the `/rustfs/rpc/read_file_stream` endpoint. The handler in `crates/ecstore/src/disk/local.rs:1791` uses `PathBuf::join()` to concatenate a user-controlled `path` parameter onto

This vulnerability resides within the Quarkus RESTEasy Reactive (or REST) HTTP layer’s response writing mechanism. When the framework sends a

The vulnerability exists within the `UriTemplate` class’s URI matching logic when processing RFC 6570 exploded array patterns (e.g., {/list}). The

The open redirect vulnerability in Directus arises from insufficient validation within the SAML 2.0 authentication flow. Specifically, the `RelayState` parameter,

The vulnerability exists within the `crypto/rsa` library’s `NewPrivateKey` function. When constructing an RSA private key from its raw components (the

The vulnerability (CVE-2026-XXXXX) is an authenticated Remote Code Execution flaw stemming from an arbitrary file write primitive. An attacker with