3 casos · pág. 1/1
Researcher Pedro Cruz (Hakai Security / The Hacking Club) disclosed nine vulnerabilities in widely used server-side PDF generation libraries, with a combined footprint of over 90 million monthly installs. The cases range from RCE (ReportLab, ReLaXed) through arbitrary file read and SSRF (WeasyPrint, Browsershot) to DoS and file/directory …
The Yokai research team at Hakai Security disclosed CVE-2026-40083, a SQL injection vulnerability in Cacti versions up to and including 1.2.30. An authenticated user with SNMP management (agent) permissions can run arbitrary SQL queries, reading or modifying the entire database. Exposed data includes bcrypt credential hashes, API tokens, …
The Hakai Security Research Team disclosed CVE-2026-44706, a SQL Injection in Chatwoot versions <= 4.11.1. Any authenticated user with agent privileges, the lowest access level, can read the entire PostgreSQL database. The flaw sits in the FilterService, where user input is interpolated directly into SQL. Exposed data includes bcrypt pass…
