•24 minutes ago•CVE-2025-67726
7.5CVE-2025-67726: Denial of Service via Quadratic Parameter Parsing in Tornado httputil
A denial of service vulnerability in Tornado versions 6.5.2 and below arises from excessive iteration in its parameter parser. The `_parseparam` function in `httputil.py` parses parameters in HTTP headers using an inefficient nested loop that counts double quotes from index zero. This implementation exposes a quadratic $O(n^2)$ complexity curve when processing quoted headers containing a high volume of semicolons, leading to CPU exhaustion and blocking the asynchronous event loop.
1 views•6 min read
•about 1 hour ago•GHSA-42H9-826W-CGV3
7.5GHSA-42H9-826W-CGV3: Denial of Service via Uncontrolled Recursion in Axios formDataToJSON
An uncontrolled recursion vulnerability (CWE-674) in the Axios HTTP library allows remote attackers to cause a Denial of Service (DoS) by submitting form-data with deeply nested property keys. When Axios converts this form-data to JSON, it recursively traverses the path segments without establishing a maximum depth limit, resulting in a maximum call stack size exhaustion and a hard process crash in Node.js environments.
3 views•8 min read
•about 9 hours ago•CVE-2026-47296
7.8CVE-2026-47296: Elevation of Privilege via SQL Injection in Microsoft SQL Server Internal Stored Procedures
CVE-2026-47296 is a high-severity local Elevation of Privilege (EoP) vulnerability in Microsoft SQL Server. The issue stems from the improper neutralization of special elements within internal database routines, allowing a low-privileged authenticated user to execute arbitrary database queries with the privileges of the database owner or system administrator. Microsoft has addressed this vulnerability in its July 2026 security updates.
7 views•5 min read
•about 9 hours ago•CVE-2026-47295
8.8CVE-2026-47295: SQL Injection and Privilege Escalation in Microsoft SQL Server
CVE-2026-47295 is a high-severity elevation of privilege vulnerability in Microsoft SQL Server (2016 through 2025). An authenticated, low-privileged attacker can execute remote SQL injection commands within system stored procedures to elevate permissions to sysadmin.
9 views•6 min read
•3 days ago•GHSA-8RQH-VXPR-X77P
4.3GHSA-8RQH-VXPR-X77P: Stored Cross-Site Scripting via MIME Type Spoofing in Plone REST API
A stored Cross-Site Scripting (XSS) vulnerability exists within plone.restapi, the REST API package for Plone content management system. By supplying a spoofed input MIME type (text/x-html-safe), an attacker can mislead the rendering layer (plone.app.textfield) into assuming that the supplied content is already sanitized. This causes the system to skip the safe_html transform, allowing arbitrary JavaScript to execute in the victim's browser when they view the compromised page.
11 views•7 min read
•3 days ago•CVE-2026-11400
8.0CVE-2026-11400: Privilege Escalation via Untrusted Search Path in AWS Advanced JDBC Wrapper
An untrusted search path vulnerability in the GlobalDatabasePlugin component of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL allows authenticated, low-privilege database users to hijack administrative session queries. By defining a custom function in a writable schema such as the public schema, an attacker can hijack queries executed automatically during driver-level topology detection. When a highly privileged database user connects to the database utilizing an affected version of the wrapper, the custom function executes under their security context, enabling remote privilege escalation to rds_superuser.
13 views•6 min read
•3 days ago•CVE-2026-27771
8.2CVE-2026-27771: Authentication Bypass and Information Disclosure in Gitea Container and Composer Registries
CVE-2026-27771 represents a critical security flaw in Gitea and Forgejo (up to and including version 1.26.1) involving missing authorization checks (CWE-862). Unauthenticated remote attackers can query, enumerate, and download private container images from the OCI-compliant container registry. Additionally, unauthorized users can retrieve private or internal source repository URLs via the Composer package registry metadata API. A public proof-of-concept exists, and threat metrics indicate highly active scanning and exploitation risks.
47 views•7 min read
•3 days ago•GHSA-CVPC-HCCG-WMW4
8.8GHSA-CVPC-HCCG-WMW4: Missing Authorization in Formie Administrative Settings Allows Privilege Escalation
A missing authorization vulnerability in the Formie plugin for Craft CMS prior to version 3.1.28 allows low-privileged Control Panel users to read and modify sensitive administrative settings, configuration options, and third-party integrations.
8 views•6 min read
•3 days ago•CVE-2026-53598
7.5CVE-2026-53598: Arbitrary File Read via File Reference Expansion in Microsoft Prompty
CVE-2026-53598 is a directory traversal and arbitrary file read vulnerability in Microsoft Prompty ecosystem loaders across multiple languages. Prior to version 2.0.0-beta.2, the loaders resolved `${file:...}` reference strings inside frontmatter configuration blocks without enforcing that the target file paths resided within authorized directories. This deficiency allows an attacker-controlled configuration file to read sensitive operating system and application files through absolute paths, directory traversal, or symbolic link escapes. The issue is addressed across the Python, C#, Node.js/TypeScript, and Rust ecosystems.
9 views•6 min read
•3 days ago•GHSA-MFR4-MQ8W-VMG6
7.3GHSA-MFR4-MQ8W-VMG6: Path Traversal in proot-distro copy Command Allows Container Escape
A directory traversal vulnerability exists in the copy subcommand of the proot-distro utility. Due to incomplete path sanitization, local attackers or malicious scripts can read from or write to arbitrary files outside the container rootfs, bypassing isolation barriers and potentially gaining unauthorized access or persistent execution on the host system.
10 views•7 min read
•3 days ago•GHSA-8QQM-FP2Q-V734
8.2GHSA-8QQM-FP2Q-V734: Authorization Bypass in Skipper's Open Policy Agent Integration
An authorization bypass vulnerability in the Open Policy Agent (OPA) integration of the Skipper HTTP router allows unauthenticated remote attackers to bypass OPA policy inspection. When an incoming HTTP request declares a Content-Length exceeding Skipper's configured maxBodyBytes limit, Skipper bypasses body parsing and forwards an empty document to OPA, while transmitting the full, uninspected payload intact to the upstream backend.
11 views•6 min read
•3 days ago•CVE-2026-53597
8.7CVE-2026-53597: Remote Code Execution in Microsoft prompty via Insecure gray-matter Parsing
CVE-2026-53597 is a high-severity code injection vulnerability in Microsoft's prompty library, specifically affecting the TypeScript loader (@prompty/core). Due to an insecure default configuration in the underlying gray-matter metadata parser, processing untrusted prompt files containing executable JavaScript blocks inside the frontmatter results in arbitrary remote code execution within the security context of the parent Node.js process.
9 views•6 min read