🚨 CVE-2026-112295
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
🎖@cveNotify
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
🎖@cveNotify
GitHub
FlyCms/backend/src/main/java/com/flycms/module/user/service/UserService.java at edfdf724c3b944310f60c29aa755d03a00a75837 · sunkaifei/FlyCms
FlyCms 是一个类似知乎以问答为基础的完全开源的JAVA语言开发的社交网络建站程序，基于 Spring Boot+Bootstrap3+MyBatis+MySql+Solr +Ehcache应用架构，专注于社区内容的整理、归类和检索，它集合了问答，digg，wiki 等多个程序的优点，帮助用户轻松搭建专业的知识库和在线问答社区。业务模块包括：权限管理，会员管理，角色管理，定时任务管理（调...
🚨 CVE-2026-112296
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
🎖@cveNotify
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
🎖@cveNotify
GitHub
FlyCms/README.md at edfdf724c3b944310f60c29aa755d03a00a75837 · sunkaifei/FlyCms
FlyCms 是一个类似知乎以问答为基础的完全开源的JAVA语言开发的社交网络建站程序，基于 Spring Boot+Bootstrap3+MyBatis+MySql+Solr +Ehcache应用架构，专注于社区内容的整理、归类和检索，它集合了问答，digg，wiki 等多个程序的优点，帮助用户轻松搭建专业的知识库和在线问答社区。业务模块包括：权限管理，会员管理，角色管理，定时任务管理（调...
🚨 CVE-2026-8168
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
🎖@cveNotify
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
🎖@cveNotify
🚨 CVE-2026-107194
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.
🎖@cveNotify
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.
🎖@cveNotify
jakkaru.de
Sungrow Vulnerability Exposes Gigawatts of Power Worldwide | Jakkaru Insights
Jakkaru proactively defeats threats with penetration testing, ensuring confidence in your business’s future
🚨 CVE-2026-88647
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
🎖@cveNotify
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
🎖@cveNotify
Gist
gist:f98ec3de1a871fdfc02b70b8b9ba7642
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-67693
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
🎖@cveNotify
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
🎖@cveNotify
🚨 CVE-2026-84012
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-84013
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-84014
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-84015
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-84016
Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-84017
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-102066
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.
🎖@cveNotify
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.
🎖@cveNotify
🚨 CVE-2026-101952
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.
🎖@cveNotify
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.
🎖@cveNotify
🚨 CVE-2026-102460
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.
The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.
This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.
The impacted component Maven coordinate is io.vertx:vertx-web
🎖@cveNotify
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.
The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.
This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.
The impacted component Maven coordinate is io.vertx:vertx-web
🎖@cveNotify
GitHub
ChainAuthHandler bypasses scope checks on pre-authenticated users
A scope bypass vulnerability exists in Eclipse Vert.x Web's `ChainAuthHandler` when used with scope-requiring authentication handlers such as `JWTAuthHandler` or `OAuth2AuthHandler`. When a use...
🚨 CVE-2026-58099
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.
An unprivileged local user may be able to exploit these races to escalate privileges.
🎖@cveNotify
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.
An unprivileged local user may be able to exploit these races to escalate privileges.
🎖@cveNotify
🚨 CVE-2026-58100
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.
An unprivileged local user may be able to exploit these races to escalate privileges.
🎖@cveNotify
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.
An unprivileged local user may be able to exploit these races to escalate privileges.
🎖@cveNotify
🚨 CVE-2026-111555
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
🎖@cveNotify
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
🎖@cveNotify
Redhat
CVE-2026-111555 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-111710
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
🎖@cveNotify
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
🎖@cveNotify
GitHub
netcore-router-public-refs/2026.10.15-netcore-nr256cn-basic-auth-null-deref.md at a44d562736b41c944223297e9144d2ad7fa2aff1 · lukadqq/netcore…
Minimal public vulnerability references for Netcore router firmware (CVE coordination) - lukadqq/netcore-router-public-refs
🚨 CVE-2026-111715
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
🎖@cveNotify
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
🎖@cveNotify
GitHub
arkon/app/routers/wiki.py at v0.9.2 · nduckmink/arkon
Arkon: Enterprise AI Knowledge Hub & MCP Server. Self-hosted knowledge base for teams to manage RAG contexts, access policies, and AI skills. Connect Claude and other LLMs via Model Context...
🚨 CVE-2026-111720
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
🎖@cveNotify
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
🎖@cveNotify
GitHub
fish-island-backend/src/main/java/com/cong/fishisland/config/CorsConfig.java at 7c61b7861e99d3970beb34103c244b79e4de7d88 · lhccong/fish…
摸鱼岛🎣后端 基于爬虫 ➕ Netty ➕ SpringBoot ➕Redis➕ MySQL 开源🌟一站式摸鱼网 - lhccong/fish-island-backend