Author name: UNDERCODE

CVE-2026-57576 is a denial-of-service vulnerability affecting the Plone content management system, specifically within the `plone.app.contenttypes` and `plone.app.dexterity` packages. The flaw

Formie control panel action formie/sent-notifications/get-resend-modal-content is vulnerable. The action maps to SentNotificationsController::actionGetResendModalContent. It only calls requireAcceptsJson(). It does not enforce

The Klever blockchain implements a BDN (Boneh-Drijvers-Neven) BLS multi-signature scheme over the BLS12-381 curve to finalize blocks. The implementation resides

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn’s AsyncParser can perform quadratic work when a single JSON

Intro: The vulnerability is stored cross-user XSS in OpenC3 COSMOS. A user with system_set can save a telemetry screen. The

GET /log is enabled by default in config/node/api.yaml with open: true. The route is registered in network/api/api.go. The endpoint performs

The vulnerability affects the Craft CMS Formie plugin. The control panel action formie/integrations/form-settings is exposed. It maps to IntegrationsController::actionFormSettings. Any

to CVE-2025-XXXXX COSMOS (OpenC3) is a satellite ground station and command/telemetry framework. This vulnerability allows an authenticated non-admin user to

The VM built-in function KleverUpdateAccountPermission is always-active and rewrites an account’s entire permission set. It is registered in creator.go lines

The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default. It is configured in config/node/api.yaml. A remote unauthenticated

Mesop is a Python-based UI framework that allows users to build web applications. Prior to version 1.3.4, the unauthenticated `/__csp__`

JLine3 is a Java library for handling console input, and its built-in nano editor supports a regex search mode. When

The PATCH /api/settings endpoint accepts a JSON body and writes it directly to persistent settings. No field whitelist is applied

9router v0.4.80@b282f05 trusts local loopback requests as authenticated. The backend allows access to /v1/ without an API key when it

The Kiro API-key validation endpoint in 9router v0.5.2 (commit 5da508a) constructs an upstream URL by interpolating a user-supplied `region` parameter

Moquette exposes an MQTT broker to untrusted clients, anonymous by default. Every byte, including pre-authentication CONNECT, is untrusted. The audited

A stored XSS vulnerability exists in REDAXO CMS 5.x. It is triggered when an administrator tries to delete a media

WPGraphQL 2.19.0 updatePost allows Contributor authorization bypass. An authenticated Contributor can publish their own draft without publish_posts. The same mutation

REDAXO CMS contains a critical Cross-Site Request Forgery (CSRF) vulnerability in the `rex_api_install_package_update` API function, which handles addon package updates.

CVE-2026-54892 is a critical denial-of-service vulnerability in Plug, the Elixir web framework used by Phoenix and other Erlang/Elixir HTTP stacks.

CVE-2026-57149 is a critical remote code execution (RCE) vulnerability in the Plone content management system, specifically affecting the `plone.app.portlets` package.

Zapros is a Python HTTP client library that handles HTTP requests and responses, including content decoding based on the `Content-Encoding`

LightRAG native markdown parser downloads external images from uploaded markdown/textpack. The only SSRF guard is _validated_addresses() in lightrag/parser/markdown/parser.py. It resolves

CVE-2026-85725 is a timing side-channel vulnerability in HKUDS LightRAG versions prior to 1.5.5. The flaw resides in the `verify_password` function

tinyauth is a forward-auth service used by Traefik, Caddy, nginx, and Envoy. The reverse proxy calls GET /api/auth/ before forwarding

The Gardener API server customverbauthorizer admission plugin checks manage-members. The check is documented for human users or groups. The implementation

LightRAG is a retrieval-augmented generation framework that exposes an HTTP API server for document management, knowledge graph operations, and query

The vulnerability resides in the DurableTask bidi RPC implementation within Hatchet. The system exposes a `handleWorkerStatus` polling endpoint that accepts

CVE-2026-76819 is a critical memory safety vulnerability affecting the Goja JavaScript engine embedded within Nuclei’s `javascript:` protocol implementation. Goja is

Tinyauth v5.0.7 exposes unauthenticated login at POST /api/user/login. loginHandler is registered in internal/controller/user_controller.go:45. It accepts JSON credentials in internal/controller/user_controller.go:50. Before

The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every

The LightRAG WebUI renders assistant/answer chat content as raw HTML. react-markdown uses rehypePlugins={ } and skipHtml={false}.</h2> <h2 style="color: blue;">No rehype-sanitize,

CVE-2026-94462 is a broken access control / Insecure Direct Object Reference (IDOR) vulnerability in Spree Commerce, an open-source e-commerce solution

CVE-2026-91129 is a Server-Side Request Forgery (SSRF) vulnerability in the Home Assistant Green device, specifically within the Internet Printing Protocol

CVE-2026-91130 is a stored cross-site scripting (XSS) vulnerability affecting the Statistics Graph card in Home Assistant versions prior to 2026.7.0.

The Traefik BasicAuth middleware deduplicates concurrent credential checks through singleflight.Group. This design avoids hashing the same password many times at

Cloudreve admin API exposes OAuth scopes. Admin.Read should inspect only. Admin.Write should mutate state. In routers/router.go admin group baseline is

CVE-2026-61670 is a local information disclosure vulnerability in microsandbox, an easy, fast, local-first microVM runtime and library, affecting versions prior

CVE-2026-58268 is a high-severity denial-of-service vulnerability in the SIPGO library, a SIP stack for writing SIP services in Go. The

Deepstream uses Valve ConfigPermission to enforce record permissions. Valve maps record actions to rule types through RULES_MAP. The map is

The request-filtering-agent npm package provides HTTP and HTTPS agents designed to block requests to private IP addresses, a common security

OpenCVE is a vulnerability intelligence platform that aggregates CVE data from multiple sources and allows users to subscribe to vendors

dasel’s JSON and XML readers parse nested structures with unbounded recursion. Each nesting level consumes one native Go stack frame.

The VeloCloud Orchestrator (VCO) on-premises deployment contains an improper input validation vulnerability (CWE-20) that allows a remote, unauthenticated attacker to

The CVE-2026-94127 vulnerability is a critical heap-based buffer overflow (CWE-122) that resides within the F5 BIG-IP Access Policy Manager (APM)

9router trusts X-9r-Real-Ip to identify localhost. The header should only come from custom-server.js. custom-server.js derives it from TCP socket. custom-server.js

9router uses a progressive login lockout. It locks after five failed attempts. The lockout key is the client IP. The

Affected component: Sync-in Server v2.3.0. Endpoint: POST /api/app/sync/operation/diff/:id. Vulnerable file: backend/src/applications/sync/dtos/sync-operations.dto.ts. The sync diff endpoint accepts pathFilters. pathFilters is user-controlled.

Sync-in Server v2.3.0 exposes POST /api/auth/token at auth.controller.ts:50-55. The endpoint uses AuthLocalGuard, which validates only username and password. After guard

Sync-in Server v2.3.0 exposes POST /api/app/sync/register. The endpoint accepts credentials and a TOTP code. It is used to register a

1. CVE-2022-32149 affects golang.org/x/text/language.ParseAcceptLanguage. The parser processes BCP 47 language tags from Accept-Language. 3. Malformed long tag lists trigger quadratic-time

The pquerna/otp library for Go implements TOTP (Time-based One-Time Password) generation and validation according to RFC 6238. TOTP codes are

CVE-2026-7273 is a stack-based buffer overflow vulnerability (CWE-121) that resides in the CGI program of the Zyxel GS1900 series switch

CVE ID: CVE-2026-XXXX (Pending Assignment) Hatchet versions v0.86.26 and below are vulnerable to an OAuth state cross-site request forgery (CSRF)

In affected Obot versions, a remote MCP server URL is accepted at registration. The URL is attacker-controlled and is fetched

Mnemosyne Sync Server used JWT bearer tokens for client authentication. Before v3.10.1, the auth check in mnemosyne/core/sync_server.py decoded the JWT

AnyIO is an asynchronous concurrency and networking framework that runs on top of asyncio or Trio. In version 4.14.0, the

Capsule is a multi-tenancy and policy-based framework for Kubernetes that enables cluster administrators to define tenants with strict isolation boundaries.

How CVE-2026-64847 Works AnyIO is a Python library that provides a unified asynchronous API across asyncio and trio. It is

A parameter order bug in internal/webhook/tenant/validation/hostname_regex.go causes the hostnameRegexHandler.OnUpdate webhook to validate the old Tenant object’s AllowedHostnames.Regex instead of the

Obot is an MCP registry server. Registry authentication is enabled with OBOT_SERVER_ENABLE_REGISTRY_AUTH=true. In affected versions, that setting does not protect

to CVE-2024-XXXXX CVE-2024-XXXXX is a critical path traversal vulnerability affecting Perses, an open-source dashboard and visualization tool for observability data.

The AnyCable realtime server before version 1.6.15 embeds a hardcoded authentication token, authToken = “secret”, in its publicly available source

The Pusher-compatible REST API signs requests using HMAC. The signed string includes auth_key, auth_timestamp, auth_version, body_md5, and auth_signature. In pusher/http.go,

A bearer token with only pull and push scopes can delete manifests and blobs from a zot registry. The bearer

AnyIO is a Python library providing a unified asynchronous I/O interface across multiple event loops. The vulnerability CVE-2026-63374 affects versions

CVE-2026-63458 is a high-severity authorization bypass vulnerability affecting Perses, an open-source dashboard and visualization project for observability data. Prior to

Perses is an open-source dashboard and visualization platform for observability data. CVE-2026-63199 is a high-severity authorization flaw (CVSS 8.3) affecting

The vulnerability exists in app/Livewire/Services/Upgrade.php::doUpgrade(). The method performs a service downgrade proration calculation. It then grants a user credit refund.

frain-dev/convoy up to v26.6.2 has a broken object level authorization flaw. The vulnerable endpoint is GET /api/v1/projects/{projectID}/sources/{sourceID}. Any authenticated caller

CVE-2025-10354 is a reflected XSS issue in Semantic MediaWiki Special:FacetedSearch. The original flaw involved the q query parameter. The q

Semantic MediaWiki’s query debug output feature, accessible via `format=debug` or the `debug` request parameter on Special:Ask, is assembled by the

The Semantic MediaWiki extension exposes an API module named smwtask. The module is reached through api.php?action=smwtask. It performs no authorization

Semantic MediaWiki’s Special:URIResolver takes a user-supplied subpage parameter and resolves it into a MediaWiki object. The special page then issues

The vulnerability arises from improper neutralization of user-supplied input in the `Special:SearchByProperty` special page of Semantic MediaWiki. When a user

The vulnerability resides in the `Special:Ask` page of the Semantic MediaWiki extension, specifically when the `headers` parameter is set to

CVE-2025-66474: Technical Analysis of XWiki Rendering Output Escaping Bypass Leading to Remote Code Execution XWiki Rendering is a generic rendering

CVE-2026-77615 is a stored cross-site scripting vulnerability in the Paella Player, a multi-stream video player library bundled with the Opencast

CVE-2026-30852 affected vars_regexp. It is a placeholder double-expansion flaw. Caddy’s Replacer processes placeholders. First pass expands operator templates. If attacker

— How the Vulnerability Works soupsieve compiles CSS selector strings using a set of hand-written regular expressions. The shared `IDENTIFIER`

The SHCParser class within the org.hl7.fhir.r5 Java library fails to enforce a maximum decompressed size limit when processing compressed Smart

CVE-2026-84997 is a high-severity denial-of-service vulnerability affecting the ReactPHP HTTP component, specifically the `React\Http\Io\ChunkedDecoder` class, in versions from 0.6.0 up

Steeltoe is an open-source project providing libraries for building cloud-native applications. Prior to version 4.3.0, deployments using `Steeltoe.Security.Authorization.Certificate` with `AddOrgAndSpacePolicies()`

A context safety grant was inherited by a template binding that never earned it, so rebinding a name the view

CVE-2026-50196 is referenced as a prior Steeltoe Eureka deserialization fix. That CVE addressed only the DataCenterInfo.name field. The current issue

The vulnerability exists in the `Security::detectXss()` function of Grav CMS, specifically in the `on_events` regex used to detect event-handler attributes

The HAPI FHIR library’s implementation of the Smart Health Card (SHC) parser is vulnerable to a denial-of-service condition through a

devalue.parse is a JavaScript deserialization function in the sveltejs/devalue library, designed to reconstruct complex values from strings when JSON.parse is

The OTLP log gRPC exporter loads TLS settings from environment variables but fails to apply them when creating gRPC transport

CVE-2026-85999 is a polynomial-time Regular Expression Denial of Service (ReDoS) vulnerability affecting Soup Sieve, a CSS selector library designed for

CVE-2024-27957 is a critical authenticated remote code execution vulnerability affecting Grav CMS, specifically within the Flex Objects plugin’s handling of

CVE-2026-64850 is tied to GHSA-7pgq in Grav CMS. The advisory addressed dynamic-data callable validation in Blueprint.php. The vulnerable sink is

CVE ID: CVE-2026-86049 Jupyter Server is the backend that powers Jupyter web applications, handling requests for notebooks, kernels, terminals, and

OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an

Steeltoe’s Consul discovery client constructs `ConsulServiceInstance` objects by parsing the `secure` metadata field from each service registration using bool.Parse. This

The vulnerability exists in the @platejs/core package, specifically within its HTML deserialization APIs. When an HTML string is passed to

index.php implements a fast-path static asset server before Grav boots. It is gated by user/config/plugin-asset-map.php. If that file exists, index.php

CVE-2026-82399 is a high-severity unauthenticated denial-of-service vulnerability in CoreDNS, a popular DNS server written in Go. The flaw resides in

The vulnerability works as follows in Grav CMS 2.0.16 with the admin plugin. MediaUploadTrait::deleteFile() is intended to delete media files.

The core Flex group blueprint system/blueprints/user/group.yaml access field lines 48-55 omits security@: admin.super. Its sibling account blueprint carries security@ at