exploit

The security vulnerability designated as CVE-2026-105645 affects the Ghost content management system, specifically within its external media inliner component. The

The vulnerability tracked as CVE-2026-105642 exists within the Ghost content management system, specifically affecting versions 6.56.0 through 6.66.3. It stems

CVE-2026-0770 represents a critical unauthenticated remote code execution vulnerability discovered within the Langflow AI platform. The flaw resides specifically inside

The vulnerability stems from how the `com.rabbitmq.tools.json.JSONReader.read()` method processes input strings and comments. When a JSON payload ends abruptly inside

The vulnerability stems from an incorrect order of operations in docling’s plugin initialization logic, where plugin entry points are loaded

CVE-2026-39808 is a critical operating system command injection vulnerability discovered in Fortinet FortiSandbox. The vulnerability arises due to improper neutralization

CVE-2026-105748 arises from the way docling processes serialized DoclingDocument JSON inputs through the `InputFormat.JSON_DOCLING` backend. When a user provides a

CVE-2024-3094 represents a sophisticated supply chain backdoor discovered in XZ Utils. The malicious actor systematically injected obfuscated code into upstream

DailyCVE Form: Platform: Docling Version: Before 2.132.0 Vulnerability: SSRF Guard Bypass Severity: Medium date: October 2026 Prediction: Already patched version

The vulnerability identified as CVE-2026-105742 affects the docling library, specifically within the HTML image resource loader module located at docling/backend/utils/image_resource_loader.py.

The CVE-2026-105749 vulnerability resides in multiple document parsing backends of Docling, specifically affecting the HTML, JATS, BoxNote, and OpenDocument spreadsheet

Prior to version 1.10.3, Langflow suffered from a critical Remote Code Execution vulnerability within its Model Context Protocol (MCP) stdio

The vulnerability tracked as CVE-2026-94486 resides in the Next.js development server (next dev), specifically within its Model Context Protocol (MCP)

CVE-2026-105868 is a high-severity security vulnerability affecting Payload CMS local upload configurations. The core issue arises when an application permits

When no system-installed liblz4-java library is found on the host system, the net.jpountz.util.Native.load() method extracts the bundled native library directly

The vulnerability identified as CVE-2026-105861 affects the external file upload and routing infrastructure within Payload CMS versions prior to 3.90.0

CVE-2026-94483 is a high-severity server-side request forgery vulnerability residing within the Image Optimization feature of the Next.js framework. When Next.js

CVE-2026-81625 is a critical stack-based buffer overflow vulnerability residing within the openvas-scanner component of Greenbone OS and related vulnerability management

The CVE-2026-94544 vulnerability exists within the Next.js framework. It specifically affects applications utilizing Cache Components or experimental useCache. The root

The vulnerability tracked as CVE-2026-105867 affects PayloadCMS in the storage-s3 package versions prior to 3.90.0 and canary versions before 4.0.0-canary.34.

The cyberowl codebase v1.0.0 is susceptible to critical parsing and header encoding flaws within its monitoring scrapers, specifically concerning ZDISpider

This vulnerability exists due to a validation flaw within specific core functionalities like bookmark fetching and Webmentions in the Ghost

This security advisory addresses a critical denial of service vulnerability identified in Payload CMS affecting local authentication configurations. The flaw

CVE-2026-105649 represents a critical security flaw residing within the Ghost content management system. The vulnerability specifically affects versions ranging from

The CVE-2026-105864 vulnerability resides in the `@payloadcms/plugin-multi-tenant` package used within Payload CMS. Specifically, in versions prior to 3.90.0 and canary

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route

Payload CMS contains a vulnerability related to the sanitization of user-uploaded Scalable Vector Graphics files, tracked as CVE-2026-105862. The flaw

The vulnerability tracked as CVE-2026-105648 represents an input validation flaw within the Ghost content management system. It allows unauthenticated remote

The CVE-2025-69516 vulnerability is a severe Server-Side Template Injection (SSTI) flaw residing in the reporting template preview endpoint of Tactical

Self-hosted Next.js applications utilizing the Pages Router with Statically Generated (SSG) or Incrementally Regenerated (ISR) pages are susceptible to cache

Next.js applications that combine a root-level catch-all page configuration alongside statically generated or Incremental Static Regeneration routes suffer from a

CVE-2025-66398 is an unauthenticated state pollution vulnerability. It impacts the Signal K Server software running on marine devices. Versions prior

CVE-2025-55182 is a critical security flaw in React Server Components. It permits unauthenticated remote code execution on affected servers. The

Backstage is an open-source framework used to build developer portals, orchestrating backend services, software templates, and automation tasks. Within Backstage,

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `wildcardToRegexp()` function within `twisted/mail/imap4.py` in Twisted framework version 25.5.0

The Static Site Generation (SSG) process in Quasar Framework utilizes the `getSsgPages()` hook to collect custom route definitions, including destination

The vulnerability resides within the `net.jpountz.lz4.LZ4DecompressorWithLength` convenience class in the `lz4-java` library. When applications decompress data streams or payloads using

The vulnerability resides within the `net.jpountz.lz4.LZ4BlockInputStream` class in lz4-java. Specifically, during the parsing of legacy LZ4Block stream headers, the internal

The Quasar CLI development server contains a critical vulnerability in its error-handling pipeline during Server-Side Rendering (SSR) and Static Site

The TechDocs plugin in Backstage enables teams to publish documentation generated from Markdown files alongside their source repositories. When Backstage

The vulnerability tracked as CVE-2026-105681 is an input validation flaw located within the Ghost publishing platform. Specifically, the comment querying

An IP spoofing vulnerability in Langflow’s Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allows authenticated remote attackers to

The vulnerability stems from insufficient input validation within the Ghost Content Management System, specifically inside the internal file processing components

The vulnerability stems from improper neutralization of user-supplied data during server-side rendering (SSR) and static site generation (SSG) in @quasar/app-vite.

The CVE-2024-36683 vulnerability affects the Smart Modules Products Alert (productsalert) module for PrestaShop up to version 1.7.4. This flaw belongs

The @backstage/plugin-techdocs-node package in Backstage fails to properly validate MkDocs theme configuration parameters within user-supplied repository files. When TechDocs processes

When property-file or Map-based `ConnectionFactory` setup fails while parsing the `uri` key, the library wraps the underlying exception with the

The LiquidJS template engine provides an security parameter named `ownPropertyOnly` which is designed to prevent rendering engines from accessing prototype-polluted

This vulnerability exists within the `@backstage/plugin-scaffolder-backend` package of Backstage due to improper input validation when handling task list ordering parameters.

The issue stems from a structural boundary violation in the passive scan implementation of OpenEASD prior to version 2.25.4. Passive

This vulnerability exists within the file upload handling component of Script-CMS. During the installation or content management workflow, the application

The provided GitHub repository release section lacks packaged software releases, binary tags, and signed delivery assets, creating a potential software

This vulnerability operates within the API ingestion pipeline of the Cybersecurity and Infrastructure Security Agency (CISA) catalog integration modules. When

The target repository `ElenaViewSynthesis/GymSIEGE` serves as a fleet-evaluation harness designed for running AI security-agent benchmarks (such as CyberGym-E2E, ExploitGym, and

The vulnerability stems from improper validation and sanitization of serialized user-controlled inputs within the cache management mechanism. When processing cached

Bit2611 thread-analyzer is a utility designed for parsing, visualizing, and analyzing Java process thread dumps to diagnose application deadlocks and

CVE-2026-43805 is a critical memory safety vulnerability caused by a race condition (CWE-362) within Apple’s operating system kernel state management.

The vulnerability known as CVE-2024-28185 arises within the context of source control hosting platforms where access control checks for software

CVE-2025-3648 affects the ServiceNow Now Platform through misconfigurations in Access Control Lists (ACLs). The vulnerability arises when conditional ACL rules

An authorization bypass vulnerability exists in wger Workout Manager due to flawed gym-scope checks across multiple gym management views. In

The target repository `aboutcode-data/staging-security-advisories` serves as a staging pipeline for indexing, aggregating, and verifying vulnerability disclosures before they are published

The GitHub repository `Jam0k/Public-Feeds-IOCs` exposed a vulnerability where public threat intelligence feeds were published without access controls or proper release

The repository Gracephotovoltaic124/vlnr lacks official releases and binary packages, leaving the codebase without cryptographic signatures or tagged version milestones. When

The vulnerability stems from the integration of an outdated Chromium kernel component inside the Alipay SecurityGuard SDK. This underlying engine

In the context of vulnerability reporting and scoring tools such as RogoLabs CNAScoreCard, security risks often stem from data handling,

The mentioned vulnerability revolves around missing or incomplete cryptographically sound integrity enforcement during component archive downloads and execution phases within

The CVE-2024-45387 vulnerability originates from incomplete input validation and unsafe handling of HTTP requests within reverse proxy server software environments.

CVE-2025-35991 is a medium-severity vulnerability that affects the Unified Extensible Firmware Interface (UEFI) firmware implementation on certain Intel processor platforms,

CVE-2026-41508 describes a vulnerability in Coraza’s multipart body processor where `io.ErrUnexpectedEOF` is treated as a benign condition, causing the `MULTIPART_STRICT_ERROR`

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase

CVE-2026-32743 is a stack-based buffer overflow vulnerability affecting PX4 Autopilot, an open-source autopilot stack for drones and unmanned vehicles. Versions

Coraza enforces SecArgumentsLimit. Default value is 1000. AddGetRequestArgument checks argument limit. AddPostRequestArgument checks argument limit. AddPathRequestArgument checks argument limit. When

CVE-2026-49252 is a critical prototype pollution vulnerability (CWE-1321) affecting the @deepstream/server package versions prior to 10.0.5. Prototype pollution occurs when

CVE-2025-48757 is a critical insufficient Row-Level Security (RLS) policy vulnerability in Lovable-generated Supabase applications, allowing remote unauthenticated attackers to read

Payload CMS is a free and open-source headless content management system that allows developers to define authentication collections with field-level

Payload Ecommerce is a plugin ecosystem for Payload CMS. The advisory affects deployments using @payloadcms/plugin-ecommerce. The vulnerable path requires the

CVE-2024-3094 is a critical software supply chain backdoor discovered in XZ Utils versions 5.6.0 and 5.6.1, the ubiquitous compression library

CVE-2026-105846 is a moderate-severity open redirect vulnerability affecting the Payload CMS authentication flow. The flaw resides in the `@payloadcms/next` package

The vulnerability CVE-2024-2333 affects CodeAstro Membership Management System 1.0. It is a SQL injection flaw located in the `/add_members.php` file,

Payload CMS is a headless CMS and application framework. The advisory concerns sort query handling in Payload. Under certain conditions,

CVE-2025-47278 affects Flask, a core dependency of Faraday, a collaborative penetration testing and vulnerability management platform. In Flask 3.1.0, the

The describes a release pipeline failure in Danube-Labs/javv-poc, not a numbered CVE. The release v0.6.0 was published on 2026-10-06. Its

CVE-2026-57967 is a critical authentication bypass vulnerability in Apache ActiveMQ Artemis and Apache Artemis that allows unauthenticated remote attackers to

CVE-2026-105852 is a missing authorization vulnerability in Payload CMS, a free and open-source headless content management system. The flaw resides

CVE-2026-105848 is a missing authorization vulnerability in the `@payloadcms/plugin-stripe` component of Payload CMS, a free and open-source headless content management

CVE-2026-105795 is a path traversal vulnerability (CWE-22) in Microsoft Kiota, an OpenAPI-based HTTP client code generator used to produce API

CVE-2026-105799 is a query injection vulnerability in the @langchain/redis integration of the LangChain framework. The flaw resides in the way

A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag (EnforceLabels) after it was set, resulting in

CVE-2026-105847 is a high-severity information disclosure vulnerability in Payload CMS, a free and open-source headless content management system. The flaw

CVE-2026-105854 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the Payload CMS npm package. The flaw resides in

CVE-2026-104850 is a high-severity authentication flaw in the official Model Context Protocol (MCP) TypeScript SDK. The vulnerability exists because the

Payload is a free and open source headless content management system (CMS) built on Node.js, widely used for building modern

CVE-2021-47815 is a denial of service vulnerability in Nsauditor 3.2.3, specifically affecting the registration code input field. The flaw resides

CVE-2026-105851 is a critical improper access control vulnerability (CWE-284) affecting Payload CMS, a free and open source headless content management

CVE-2026-105849 is a high-severity authorization bypass vulnerability affecting Payload CMS, a free and open-source headless content management system. The flaw

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions

openapi-python-client is a tool that generates type-safe Python clients from OpenAPI 3.0+ documents. Prior to version 0.29.1, the generator failed

CVE-2026-105796 is a code injection vulnerability in Microsoft Kiota, an OpenAPI-based HTTP client code generator.The flaw resides in the Java

CVE-2026-105845 is a critical SQL injection vulnerability affecting the Payload CMS (payloadcms/payload) when used with SQLite or Postgres adapters. The

Prototype pollution is a vulnerability that occurs when an attacker can inject properties into a JavaScript object’s prototype, affecting all