exploit

SmarterTools SmarterMail versions prior to build 9610 contain a critical cryptographic flaw in their file and email sharing endpoints. These

How the Vulnerability Works The vulnerability exists in GDAL versions 3.1.0 through 3.13.0 in the netCDF driver. Specifically, the function

CVE-2026-42239 resides in the cookie‑setting logic for Budibase’s session JWT. In `packages/backend-core/src/utils/utils.ts:218`, the `budibase:auth` cookie is hardcoded with httpOnly: false,

This Denial-of-Service (DoS) vulnerability affects React Router v7 when it operates in Framework Mode and also impacts Remix v2.9.0 and

A local privilege escalation (LPE) vulnerability exists in snapd on Ubuntu Linux. The flaw (CVE-2026-3888) arises from an unintended interaction

A vulnerability in MLflow versions up to 3.10.1.dev0, tracked as CVE-2026-2651, allows unauthorized access to multipart upload (MPU) endpoints when

When the Vercel CLI runs in non-interactive mode—either explicitly flagged (–non-interactive) or auto‑detected because an AI agent is controlling the

CVE-2026-6832 describes an arbitrary file deletion vulnerability in Hermes WebUI, a tool for managing AI conversations. The flaw resides in

The vulnerability (pending CVE) resides in Nuclio Dashboard’s project management API. The dashboard uses OPA (Open Policy Agent) for authorization

The vulnerability exists in mongoose_multipart.c, specifically in the function mg_http_multipart_continue_wait_for_chunk(), which handles multipart form‑data uploads. The flaw is an integer

CVE-2026-7807 is a Local File Inclusion (LFI) vulnerability in SmarterMail that allows any authenticated user to read arbitrary `.json` files

CVE-2026-24162 is a high-severity vulnerability in NVIDIA’s Transformers4Rec for Linux, a library for building sequential recommendation models. The root cause

The vulnerability arises from how WebOb normalizes the HTTP `Location` header. When generating a redirect response, WebOb attempts to ensure

CVE-2026-46818 is a high‑severity flaw in the File Transmission component of Oracle Payments within Oracle E‑Business Suite (versions 12.2.3‑12.2.15). The

CVE-2026-46817 is a critical vulnerability in the File Transmission component of the Oracle Payments module, part of the Oracle E-Business

How CVE-2026-44487 Works CVE-2026-44487 is a credential leak vulnerability in Axios’s Node.js HTTP adapter that occurs during specific proxy-to-direct redirect

CVE-2026-45337 is a session spying vulnerability in Better Auth’s `deviceAuthorization` plugin. When enabled and a third party can observe a

CVE‑2026‑8711 is a critical heap‑based buffer overflow vulnerability in the NGINX JavaScript (njs) module that arises when the `js_fetch_proxy` directive

How CVE-2026-46841 Works This vulnerability resides in the General component of Oracle REST Data Services (ORDS). It affects versions 24.2.0

CVE-2026-46837 is a vulnerability in the Security component of Oracle Flow Manufacturing, a module within the Oracle E-Business Suite. It

Intro CVE‑2026‑46839 is a critical vulnerability in the Core component of Oracle REST Data Services (ORDS). It affects all supported

Intro The vulnerability arises from how Axios constructs a regular expression to parse the browser’s `document.cookie` when reading a specific

The vulnerability stems from a critical oversight in the message edit validation logic of the `matrix-sdk-ui` crate in versions prior

This vulnerability resides in the `MaxAliasesLimiter` extension, a security control designed to mitigate resource exhaustion attacks. The root cause is

The vulnerability stems from the matrix-sdk-crypto crate’s failure to validate the sender’s user ID when processing an Olm-encrypted to-device message

Intro CVE-2026-6942 is an OS command injection vulnerability in radare2-mcp, the Model Context Protocol (MCP) server implementation for the open-source

Intro to How This CVE Works: The `DynamicClientRegistrationControllerregister` action in the Doorkeeper OAuth provider hard-codes `confidential: false` when dynamically registering

CVE-2026-46840 is a critical authentication bypass vulnerability in Oracle REST Data Services (ORDS), specifically within its Backend‑as‑a‑Service (BaaS) component. Affected

The vulnerability stems from incomplete header filtering in three Apache Camel components: `CxfRsHeaderFilterStrategy` (camel-cxf-rest), `CxfHeaderFilterStrategy` (camel-cxf-transport), and `KnativeHttpHeaderFilterStrategy` (camel-knative-http). While

The QueryDepthLimiter extension in Strawberry GraphQL fails to implement proper cycle detection when processing GraphQL fragment spreads. The `determine_depth` function

CVE-2026-7201 is a critical authorization bypass vulnerability (CWE-639) affecting Progress Sitefinity web services. It allows a remote authenticated attacker to

CVE-2026-7195 is a high‑severity flaw in Progress Sitefinity’s web services, caused by improper input validation (CWE‑20). The issue exists because

Intro: How CVE-2026-48710 Works This vulnerability, nicknamed “BadHost,” exposes a critical flaw in how the Starlette ASGI framework reconstructs incoming

CVE-2026-7313 is a vulnerability in Progress Sitefinity that stems from the insecure handling of authentication secrets within its web services.

CVE-2026-7312 is a critical severity vulnerability (CVSS 3.1 Base Score: 10.0) affecting Progress Sitefinity, a popular .NET-based Web Content Management

How CVE-2026-34993 Works The vulnerability resides in the `CookieJar.load()` method of the aiohttp library, used for loading cookies from a

Technical Analysis: How CVE-2026-42211 Works This vulnerability arises from a deserialization flaw in React Router’s vendored copy of turbo-stream v2,

How CVE-2026-44023 Works This critical Server-Side Request Forgery (SSRF) and path traversal vulnerability stems from how Docling Core versions `1.5.0`

Intro CVE-2026-44018 affects Docling’s METS-GBS backend. The vulnerability arises from insecure XML parsing and insufficiently controlled archive extraction. When processing

Intro: How CVE-2026-30963 Works: Capsule, a Kubernetes multi-tenancy framework, uses a validating webhook to block namespace hijacking via standard update/patch

The vulnerability arises from unsafe interpolation of user‑supplied environment variables (KERNEL_XXX) into Jinja2 templates that are used to generate Kubernetes

Technical Analysis of CVE-2026-49143 CVE-2024-29131 is a critical vulnerability in the `browserstack-runner` npm package, affecting versions up to and including

CVE-2026-47265 is a moderate‑severity information disclosure vulnerability in the AIOHTTP client library for Python. It affects all versions prior to

An integer divide-by-zero vulnerability was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) within the E2SM-KPM RAN Function’s PRB utilization metric calculation. The

An attacker can trigger a denial-of-service (DoS) condition in quic‑go’s HTTP/3 client and server by sending a specially crafted QPACK‑encoded

Intro This vulnerability exists in Jupyter Enterprise Gateway because the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests

The MacGregor VDR G4e web interface exposes a sensitive file‑editing function that allows any authenticated administrator to directly modify authentication‑related

How CVE-2026-45286 Works This flaw resides in the Nextcloud Calendar app’s attendee suggestion endpoint. When a user starts typing a

Nextcloud is an open-source content collaboration platform. The vulnerability CVE-2026-45285 affects versions 32.0.0 to 32.0.8 and 33.0.0 to 33.0.2. It

In Docling versions between 2.82.0 (inclusive) and 2.91.0 (exclusive), the Playwright-based HTML rendering feature contains a critical design flaw when

The United States Patent and Trademark Office (USPTO) patent XML parser within Docling prior to version 2.74.0 was vulnerable to

The brace-expansion library, commonly used in Node.js projects to generate arbitrary strings from brace patterns (e.g., `{a..z}` or {1..100}), implements

The vulnerability resides in the prohibited UID/GID feature of Jupyter Enterprise Gateway, which is designed to block kernel launches with

CVE-2026-42342: Denial-of-Service via Unbounded Path Expansion in `__manifest` Endpoint The vulnerability arises in React Router’s Framework Mode and in Remix

This vulnerability resides in Docling’s LaTeX backend, which processes documents for conversion. The core issue is a lack of path

Docling’s HTML backend fails to properly validate resources when handling untrusted HTML documents. The core issue stems from accepting `file://`

The `DomainZones.add` API endpoint fails to sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled

CVE-2026-48501 describes a vulnerability in GitHub CLI (gh) versions prior to 2.93.0. The flaw resides in the shared HTTP client

Froxlor’s API authentication (FroxlorRPC::validateAuth) does not enforce Two‑Factor Authentication. When an admin or customer enables 2FA on their account, the

How CVE-2026-44019 Works Docling Core versions between 2.5.0 and 2.74.1 contain a critical flaw in how they handle image reference

CVE-2026-45284 arises from an improper access control flaw in Nextcloud’s User OIDC app when integrated with LDAP. The root cause

CVE‑2026‑40181 – React Router’s redirect function in versions 7.0.0–7.14.0 and 6.7.0–6.30.3 incorrectly interprets a relative path that begins with a

How It Works The Malla dashboard collects Meshtastic network data by subscribing to public MQTT brokers. When a node announces

The HTTP server in browserstack-runner up to version 0.9.5 contains a critical path traversal vulnerability that allows unauthenticated network-adjacent attackers

The Capsule controller runs with `cluster-admin` privileges to manage tenant namespaces and policies. Its `TenantResource` custom resource allows tenant owners

The vulnerability exists because the package’s default error views output unescaped exception messages. When a malicious payload is passed via

A remote attacker with high privileges (e.g., a realm administrator setting up a malicious LDAP server, or an attacker who

CVE-2026-4630 is a medium‑severity IDOR (Insecure Direct Object Reference) vulnerability in Keycloak’s Authorization Services Protection API endpoint. The flaw allows

The OIDC token introspection endpoint is designed to allow a resource server to validate a token and obtain its metadata.

Keycloak, Denial of Service (DoS), CVE-2026-7307 (High) CVE-2026-7307 – Keycloak SAML endpoint DoS via crafted XML input CVE-2026-7307 is a

CVE‑2026‑9309 is a vulnerability in the Reader View component of Firefox for iOS that stems from improper HTML tag escaping

A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion

Intro The vulnerability stems from the EasyOCR model downloader’s lack of validation on member paths within ZIP archives. Applications often

CVE-2026-7507 is a session fixation vulnerability affecting Keycloak, an open-source identity and access management solution. The flaw resides in the

A flawed access control in Keycloak’s Account Resources user lookup endpoint allows an authenticated attacker who owns at least one

The vulnerability stems from an insecure use of the `sprintf()` function in the `/httpd_debug.asp` API endpoint. This CGI script is

Intro – How the Vulnerability Works CVE-2026-9798 is a flaw in the Client-Initiated Backchannel Authentication (CIBA) flow of Keycloak (Red

Vulnerability Deep Dive: CVE-2026-9308 This vulnerability stems from a race condition in the data sanitization process of Firefox for iOS’s

CVE-2026-7571 exposes a critical flaw in Keycloak’s OpenID Connect (OIDC) implementation. A low-privilege attacker, possessing a valid user’s credentials and

How CVE-2026-7504 Works CVE-2026-7504 is an open redirect vulnerability in Keycloak’s URL validation logic, specifically affecting clients that use a

How the CVE Works React Router versions 7.7.0 through 7.13.1 using the unstable React Server Components (RSC) APIs contain a

The vulnerability resides in Keycloak’s Fine-Grained Admin Permissions (FGAPv2). An administrator with only client management permissions can exploit a flaw

Intro CVE-2026-9796 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in Keycloak’s admin role validation. An authenticated administrator with the `manage-clients`

A vulnerability identified as CVE-2026-37978 has been discovered in Keycloak, an open-source identity and access management solution. The flaw resides

CVE-2026-45247 is a critical vulnerability in the Mirasvit Full Page Cache Warmer module for Magento 2. It stems from an

CVE‑2026‑33244 describes a stored cross‑site scripting (XSS) flaw in React Router versions 7.5.1 through 7.13.1. The vulnerability only appears when

Intro: How CVE-2026-37982 Works CVE-2026-37982 is an authentication vulnerability in Keycloak that stems from the incorrect handling of single-use tokens

In Android’s runtime safety mechanism, the UndefinedBehaviorSanitizer (UBSan) is a critical component designed to catch undefined behaviors in C/C++ code,

The vulnerability resides in multiple functions of sdp_discovery.cc, a core component of the Android Bluetooth stack handling Service Discovery Protocol

Intro – How CVE-2025-59601 Works The vulnerability resides in the factory reset mechanism exposed via the powerline communication (PLC) interface

Technical Analysis: How CVE-2026-28580 Works CVE-2026-28580 stems from an incorrect bounds check within the persistence logic of multiple Android Framework

CVE ID: CVE-2026-28586 Intro: CVE-2026-28586 is a permissions bypass vulnerability in Android’s AppOpsService.java that allows a local attacker to retrieve

CVE-2026-0097 is a vulnerability in Android’s Bluetooth Low Energy (LE) pairing logic that can be exploited by an attacker within

Intro: How CVE-2026-28577 Works CVE-2026-28577 is a tapjacking vulnerability in the Android operating system that allows a malicious application to

CVE-2025-59604 describes a memory corruption vulnerability that occurs during a memory copy operation (e.g., memcpy, memmove, or a DMA transfer)

In `onNullBinding` of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic

Intro CVE-2026-28578 is a vulnerability in the Android framework, specifically within the `DevicePolicyManagerService.java` file. The core issue is an improper

How CVE-2026-0098 Works This vulnerability resides in the `getCallingPackageName` function within `Shared.java` on the Android platform. The core issue is

CVE-2026-0100 is a critical vulnerability in Android’s resource loading mechanism (androidfw), enabling local privilege escalation without user interaction. The flaw,

The vulnerability resides in the `updateState` method of GraphicsDriverEnableAngleAsSystemDriverController.java. The ANGLE (Almost Native Graphics Layer Engine) driver is responsible for