free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

CVE-2026-44323

### Summary free5GC's UDR `nudr-dr` `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subs

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference

CVE-2026-44322

### Summary free5GC's NEF `PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId}` handler pan

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

CVE-2026-44320

### Summary free5GC's NEF mounts the `nnef-callback` route group without inbound OAuth2/bearer-token authorization. A fo

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions

CVE-2026-44318

### Summary free5GC's BSF `PUT /nbsf-management/v1/subscriptions/{subId}` handler has an unsynchronized write on the glo

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

CVE-2026-44316

### Summary free5GC's PCF `POST /npcf-smpolicycontrol/v1/sm-policies` handler (`HandleCreateSmPolicyRequest`) panics wit

历史摘要 · 未重新核验 · GitHub Advisory

Kimai has an arbitrary file read in its invoice PDF renderer (admin)

CVE-2026-44298

## Summary Users with the role `System-Admin` (`ROLE_SYSTE_ADMIN`) and the permission `upload_invoice_template` can upl

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

CVE-2026-44568

## Vulnerability Details **CWE-79**: Cross-site Scripting (XSS) The `AccountPending.svelte` component renders the admi

历史摘要 · 未重新核验 · GitHub Advisory

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability...

CVE-2026-44400

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile

历史摘要 · 未重新核验 · GitHub Advisory

eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields

CVE-2026-44214

### Summary `eventsource-encoder` does not sanitize the `event` or `id` fields of an `EventSourceMessage` before serial

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

CVE-2026-44552

# Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning ## A

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Stored XSS via page title (data[header][title]) in admin panel

CVE-2026-44737

### Summary _A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

CVE-2026-44588

## Summary The tooltip mouseover handler in `app/src/block/popover.ts` reads `aria-label` via `getAttribute` and passes

历史摘要 · 未重新核验 · GitHub Advisory

open-webui Vulnerable to Stored XSS via Model Description

CVE-2026-44721

> [!IMPORTANT] > Relationship to CVE-2024-7990 > CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XS

历史摘要 · 未重新核验 · GitHub Advisory

Electerm's full process.env exposed to renderer via window.pre.env

CVE-2026-43942

### Impact The `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serialises the entire `process.env` object and

历史摘要 · 未重新核验 · GitHub Advisory

Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click

CVE-2026-43941

### Impact Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to `shell.openExternal

历史摘要 · 未重新核验 · GitHub Advisory

Electerm runWidget has a path traversal that leads to arbitrary code execution

CVE-2026-43940

### Impact The `runWidget` function in `src/app/widgets/load-widget.js` constructs a file path by directly concatenating

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe...

CVE-2026-42794

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows

历史摘要 · 未重新核验 · GitHub Advisory

Firewall for AI

Akamai 发布了名为“Firewall for AI”的新产品页面。该产品旨在保护 AI 应用免受 DDoS 攻击和僵尸网络等网络威胁。页面未提供具体攻击活动或漏洞细节，仅概述了 Akamai 在 AI 安全领域的解决方案。由于缺乏实际

历史摘要 · 未重新核验 · Akamai Security Research

CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms

CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms

历史摘要 · 未重新核验 · CrowdStrike

CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud

CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud

历史摘要 · 未重新核验 · CrowdStrike