exploit

Prototype pollution is a vulnerability that occurs when an attacker can inject properties into a JavaScript object’s prototype, affecting all

The Vyper compiler, a Pythonic smart contract language for the Ethereum Virtual Machine, contains a memory corruption vulnerability that manifests

The CVE-2026-27963 vulnerability allows an unauthenticated attacker to inject arbitrary commands into the daily-experiments pipeline via the NVD API response

Greenbone SCAP is a Python project for SCAP data processing. The supplied is a release list, not a CVE advisory.

CVE-2026-9277 affects shell-quote quote() and parse(). quote() emits a { comment } token as followed by its text. This comments

CVE-2026-31431 is a Linux kernel vulnerability in the `algif_aead` / `authencesn` AEAD implementation that allows a local attacker to escalate

CVE-2026-102828 is a critical OS command injection vulnerability in the simple-git library for Node.js, affecting versions 3.15.0 through 4.0.0. The

CVE-2026-84411 is a critical integer underflow vulnerability in the HTTP request body handling of MikroTik RouterOS’s web management service, tracked

CVE-2026-44018 is a memory exhaustion vulnerability in Docling, a document processing library that parses diverse formats and integrates with generative

CVE-2026-44018 is a memory exhaustion vulnerability in docling versions 2.91.0 through 2.130.x. When docling detects the input format of a

CVE-2026-102600 is a prototype pollution vulnerability in @socket.io/cluster-engine. The flaw resides in the `engine.ts` file, where session IDs supplied in

The attestd-io/check-action GitHub Action operates as a CI/CD pipeline security gate that evaluates software dependencies against the Attestd security risk

The reported issue affects @simple-git/argv-parser, a parser used to classify Git environment variables before spawn. GitEnvKeys in packages/argv-parser/src/env/parse-env.ts maps editor,

Before Langflow 1.10.3, built-in components sent server-side HTTP requests to flow-author-controlled URLs. No SSRF enforcement existed for these component requests.

to CVE-2026-96747 The MongoDB Python Driver (PyMongo) contains a path resolution flaw within its client-side field level encryption (CSFLE) implementation.

CVE-2025-11454 is an authenticated SQL injection vulnerability affecting the “Specific Content For Mobile – Customize the mobile version without redirections”

CVE-2026-105760 is a resource exhaustion vulnerability in vLLM, an inference and serving engine for large language models. The vulnerability exists

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. The vulnerability resides in the IN_PLACE sanitization mode

CVE-2026-102598 is a vulnerability in Werkzeug’s `safe_join()` function that allows Windows special device names (such as NUL:) to be treated

The wp2shell vulnerability chain comprises two independent flaws in WordPress core. CVE-2026-63030 is a REST API batch-route confusion issue located

Docling is a document processing library that parses diverse formats and provides integrations with generative AI ecosystems. The vulnerability exists

CVE-Intel is a security intelligence pipeline that maps Common Vulnerabilities and Exposures (CVEs) to publicly available GitHub exploit and proof-of-concept

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication

CVE-2013-1443 is the Django long-password denial-of-service bug. browserify/pbkdf2 has the same class of flaw in its JavaScript fallback. PBKDF2 derives

The vulnerability CVE-2026-100506 is a Deserialization of Untrusted Data flaw affecting the WP Spell Check WordPress plugin (slug wp-spell-check). In

The `vulnscope-local-guardian` repository on GitHub currently has no published releases, as indicated by the page stating “There aren’t any releases

CVE-2020-6287, also known as RECON (Remotely Exploitable Code On NetWeaver), is a critical authentication bypass vulnerability affecting the SAP NetWeaver

CVE-2026-41900 is a critical vulnerability in the OpenLearnX learning platform that allows unauthenticated attackers to execute arbitrary code on the

The vulnerability identified as CVE-2022-45483 affects Lazy Mouse, a remote control application that allows a smartphone to act as a

CVE-2026-43347 is a high-severity vulnerability in the Linux kernel affecting arm64-based Qualcomm Monaco platforms, where improper memory reservation handling for

CVE-2024-10037 is an authenticated denial-of-service vulnerability affecting the GridPulse platform, specifically within its web interface. The flaw resides in the

The CVE-2026-40913 vulnerability arises from an insufficient permission check within Apache Magpie’s agent-assisted security-issue handling workflow, specifically in the skill

CVE-2024-3400 is a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software. The vulnerability allows

The WhisperPair vulnerability (CVE-2025-36911) is a critical authentication bypass in the accessory-side implementation of Google’s Fast Pair protocol, affecting hundreds

CVE-2024-0204 is a critical authentication bypass vulnerability affecting Fortra’s GoAnywhere Managed File Transfer (MFT) software, specifically versions prior to 7.4.1.

CVE-2024-21762 is a critical out-of-bounds write vulnerability in the FortiOS SSL-VPN component (sslvpnd). The flaw arises from incorrect parameter checks

CVE-2025-32429 is a critical SQL injection vulnerability affecting the XWiki platform, specifically within the `getdeleteddocuments.vm` template. The flaw resides in

CVE-2024-54499 is a critical use-after-free vulnerability residing in the ImageIO framework of Apple’s macOS. The flaw manifests when the system

CVE-2026-92753 is an authorization bypass vulnerability affecting PatrowlManager versions through 1.8.4. The flaw resides in the events and alerts API

Mercator is an open-source web application for mapping information systems. A path traversal vulnerability exists in the moment JavaScript library,

CVE-2021-44228 affects Apache Log4j 2. It is known as Log4Shell. The flaw lives in message lookup substitution. Log4j evaluates ${…}

CVE-2026-59310 is a critical path traversal vulnerability in the Syslog server component of VMware vCenter Server, carrying a CVSS score

The provided describes the releases page for the GitHub repository NullSpace-BitCradle/Threat_Intelligence_Pipeline【1†L1-L4】. It states that there are no releases available and

CVE-2026-88779 is a memory overflow vulnerability residing in the core architecture of Citrix NetScaler ADC and NetScaler Gateway appliances. The

Trigger.dev is an open-source platform for background jobs and durable workflows. The vulnerability resides in the Trigger.dev CLI version 4.5.3.

to CVE-2025-59531 Wasmtime’s implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, table.grow, and array.copy, contains a vulnerability when a preemption

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open(). It does not validate the URI scheme before

The reported issue affects the Vibe Agent FastAPI service. The service exposes LLM file-read tools on port 8899. The container

The vulnerability affects @fastify/busboy from 1.0.0 prior to 3.2.1. It is a Denial of Service in the multipart header parser.

/ws/network/proxy is an admin-only WebSocket forward-proxy endpoint. The target URL and headers are fully attacker-specifiable via query parameters. Its websocket.Upgrader

CVE-2026-96780 is an infinite loop vulnerability in figlet.js, a JavaScript FIGfont driver. The flaw resides in the text() and textSync()

CVE ID: Not provided geopy.Point and Point.from_string() are affected by a regular-expression denial-of-service condition. The issue is Moderate severity in

The dashboard replay action verifies the source run belongs to the caller’s organization. The replay request also includes a target

CVE-2026-52726 is a critical symlink directory traversal vulnerability in Dulwich, a pure-Python implementation of the Git file formats and protocols.

Dulwich’s stash.py:pop() function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree

CVE-2026-62314 is a policy bypass vulnerability in Anubis, a Web AI Firewall Utility designed to challenge users’ connections to protect

The Zammad ticketing system contains a systemic local privilege escalation vulnerability that allows any user with access to the local

The `/api/attr/getBookmarkLabels` endpoint in SiYuan Note is registered with only `CheckAuth` middleware and applies no filtering whatsoever. When invoked, it

CVE-2026-73607 is a missing authorization vulnerability in SiYuan versions before v3.7.4. The endpoint `/api/storage/getOutlineStorage` is registered with only `CheckAuth` and

CVE-2026-92949 is a vulnerability in the vm2 Node.js sandbox library, affecting versions 3.9.6 through 3.11.6. The flaw allows untrusted JavaScript

CVE-2026-102994 is a high-severity vulnerability in the pypdf library, a pure-Python PDF manipulation toolkit. The flaw resides in the parsing

devalue is a JavaScript library that serializes values into strings when JSON.stringify is not sufficient. Its uneval function generates JavaScript

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify is not sufficient, handling cyclical references, repeated

CVE-2026-103000 is a high-severity uncontrolled resource consumption vulnerability (CWE-400 / CWE-770) affecting pypdf, a free and open-source pure-Python PDF library.

CVE-2026-102998 is a high-severity vulnerability in pypdf, a free and open-source pure-Python PDF library. The flaw resides in the `pypdf/generic/_appearance_stream.py`

CVE-2026-102990 is a high-severity denial-of-service vulnerability in basic-ftp, an FTP client library for Node.js. The flaw resides in the `parseListUnix.js`

CVE-2026-100689 is a path traversal vulnerability in GitPython, affecting versions before 3.1.62. It resides in the `Submodule.update()` method, specifically in

A russh server can be driven to unbounded heap growth. The peer speaks only standard SSH messages. Default configuration is

Tornado’s StaticFileHandler serves files under a configured static root. It joins the root with the requested URI path. It calls

Tornado is a Python web framework and asynchronous networking library. In versions prior to 6.5.9, the `HTTPServerRequest.__init__` method in `tornado/httputil.py`

Fastify runs a route’s validator and, for a result shaped like { value, error }, unwraps it: an error becomes

The russh hybrid key exchange uses ML-KEM 768 and X25519. It is implemented in russh/src/kex/hybrid_mlkem.rs. The negotiated method is mlkem768x25519-sha256.

GitPython’s `Actor.name_email_regex` regular expression in `git/util.py` (line 863) is vulnerable to catastrophic backtracking, a form of Regular Expression Denial of

CVE-2026-102825 is a vulnerability in the Russh Rust SSH client and server library that allows an unauthenticated remote client to

PyJWKClient.get_signing_key_from_jwt(token) begins the JWKS verification flow in docs/usage.rst. It must decode a token payload before signature checking. It calls jwt.api_jwt.decode_complete(token,

serialize-javascript is an npm package that serializes JavaScript values to a superset of JSON, including support for regular expressions and

Axios 1.17.0 honors HTTP_PROXY / HTTPS_PROXY. Axios supports NO_PROXY host exclusions. CIDR-form NO_PROXY entries are not treated as network ranges.

DOMPurify’s `IN_PLACE` mode performs sanitization directly on the caller’s live DOM subtree rather than on a detached clone. To address

Axios is a promise-based HTTP client for Node.js and browsers. Versions 1.13.0 through 1.20.0 support HTTP/2 via the Node.js HTTP

Axios is a promise-based HTTP client used in both browser and Node.js environments. From version 1.7.0 until 1.20.0, the fetch

league/commonmark’s GitHub Flavored Markdown Table extension registers `TableStartParser` as a block-start parser. While a paragraph is the active block, the

CVE-2026-91776 is a resource management vulnerability in FasterXML jackson-databind’s `TypeDeserializerBase._findDeserializer()` method. The flaw resides in the internal `_deserializers` map, which

Axios contains a guard in the Node HTTP adapter. The guard avoids inherited Object.prototype.getHeaders as a FormData header source. The

Axios v1.18.1 contains a read-side prototype pollution gadget in its form data serialization logic. Six option properties are read from

The `DisallowedRawHtml` extension in `league/commonmark` is intended to escape raw HTML tags that are considered dangerous, such as <script>, <iframe>,

urllib3 is a widely used HTTP client library for Python that provides efficient handling of large HTTP responses through its

Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js using a regular expression that is vulnerable to Regular Expression Denial of

CVE-2026-101898 is a security vulnerability in Axios, a widely used promise-based HTTP client for Node.js and browsers. The flaw exists

Axios is a promise-based HTTP client for the browser and Node.js. From version 1.15.2 until 1.20.0, the Node HTTP adapter

The `@grpc/grpc-js` library, a pure JavaScript implementation of gRPC’s core functionality, contains a critical improper authentication vulnerability identified as CVE-2026-101916.

CVE-2026-101896: Angular SSR Denial of Service via Matrix Parameter Heap Amplification A denial of service (DoS) vulnerability was identified in

CVE-2026-91777 is a high-severity denial-of-service vulnerability in FasterXML jackson-databind. The flaw resides in the forward-reference completion logic used when deserializing

CVE-2026-101902 is a read-side prototype pollution gadget affecting the Axios HTTP client library. The vulnerability resides in the default Axios

Axios is a promise-based HTTP client for the browser and Node.js. From version 1.15.0 until 1.20.0, the `shouldBypassProxy()` function in

Axios exposes `maxRedirects` as a configuration option to limit redirect following, and setting it to `0` is a documented pattern

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability in the Satori library (CWE-116: Improper Encoding or

Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers

A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the

CVE-2026-97687 is a high-severity vulnerability in the Python urllib3 HTTP client library, affecting versions 1.26.0 through 2.7.0. The flaw resides

PyJWT is a Python library for encoding and decoding JSON Web Tokens (JWT). The `is_pem_format` function in `jwt/utils.py` is designed