Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privilege...

CVE-2026-22678

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concrete/control...

CVE-2026-8428

Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker who controls ...

CVE-2026-8426

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepa

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.  An attacker who can...

CVE-2026-8421

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/singl

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/cont...

CVE-2026-8417

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_up

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group. Any authentic...

CVE-2026-8350

Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to pr

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restrict...

CVE-2026-8205

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does no

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block ...

CVE-2026-8204

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious J...

CVE-2026-8203

Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $heigh

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concret...

CVE-2026-8197

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template render

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method in concrete/contro...

CVE-2026-8140

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/down

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator w...

CVE-2026-8135

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the Ex

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An...

CVE-2026-8134

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTempl

历史摘要 · 未重新核验 · NVD

Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.  Any unauthenticated visitor can reque...

CVE-2026-6826

Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the

历史摘要 · 未重新核验 · NVD

LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own accou...

CVE-2026-47102

LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint c

历史摘要 · 未重新核验 · NVD

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_route...

CVE-2026-47101

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role

历史摘要 · 未重新核验 · NVD

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for sec...

CVE-2026-46473

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in r

历史摘要 · 未重新核验 · NVD

An IoT-Enabled Smart Home Automation System for Energy Efficiency with Web-Based Control

本文提出并实现了一种基于物联网的智能家居自动化系统，旨在通过环境传感器和Raspberry Pi 5实现节能和用户控制。该系统监测实时环境参数（如运动、温度、湿度、光照和烟雾），并根据数据自动调整设备行为（如风扇转速和LED亮度），使用PW

历史摘要 · 未重新核验 · arXiv cs.CR

决赛直播｜第四届阿里CTF安全挑战赛

该文章报道了第四届阿里CTF安全挑战赛的决赛情况。阿里CTF（Capture The Flag）是由阿里巴巴集团主办的安全技术竞赛，旨在为安全爱好者提供一个展示和提升网络安全攻防技能的平台。本次比赛日期为2026年5月23日，通过先知社区发

历史摘要 · 未重新核验 · 先知社区

抢先加入AI时代顶尖安全团队！阿里云2027届实习生招聘来了！

该文章为阿里云2027届实习生招聘信息，发布于先知社区，内容为宣传招聘AI时代顶尖安全团队，不涉及任何威胁情报活动或安全事件。

历史摘要 · 未重新核验 · 先知社区