Recent Items
Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx
Published on 2026-09-14T17:57:41.374000+00:00
Updated on 2026-09-14T17:57:41.374000+00:00
backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
Published on 2026-09-14T17:55:45.275000+00:00
Updated on 2026-09-14T17:55:45.275000+00:00
backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Published on 2026-09-14T17:54:36.615000+00:00
Updated on 2026-09-14T17:54:36.615000+00:00
backpack/crud: MyAccountController allows changing the login email without a current-password check
Published on 2026-09-14T17:53:25.835000+00:00
Updated on 2026-09-14T17:53:25.835000+00:00
backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Published on 2026-09-14T17:52:19.185000+00:00
Updated on 2026-09-14T17:52:19.185000+00:00
Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint
Published on 2026-09-14T17:52:08.910000+00:00
Updated on 2026-09-14T17:52:08.910000+00:00
webhook through 2.8.3 Memory Exhaustion via Oversized Request Body
Published on 2026-09-14T17:52:08.259000+00:00
Updated on 2026-09-14T17:52:08.259000+00:00
Huly Platform through 0.7.426 SSRF via Print Service
Published on 2026-09-14T17:52:07.537000+00:00
Updated on 2026-09-14T17:52:07.537000+00:00
DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
Published on 2026-09-14T17:52:06.851000+00:00
Updated on 2026-09-14T17:52:06.851000+00:00
Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret
Published on 2026-09-14T17:52:06.173000+00:00
Updated on 2026-09-14T17:52:06.173000+00:00