A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can...

CVE-2026-41157

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound

历史摘要 · 未重新核验 · GitHub Advisory

File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

CVE-2026-54090

> [!NOTE] > **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existe

历史摘要 · 未重新核验 · GitHub Advisory

File Browser has incorrect access control for public directory shares via rule path rebasing

CVE-2026-54091

### Summary File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and th

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

CVE-2026-54093

### Summary filebrowser builds the download-as-zip / download-as-tar archive entry names with `filepath.ToSlash`, which

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

CVE-2026-54094

## Summary File Browser enforces per-user scope with `afero.NewBasePathFs(afero.NewOsFs(), scope)`, set up in `users/us

历史摘要 · 未重新核验 · GitHub Advisory

File Browser has a DoS Vulnerability via Public Login API

CVE-2026-54092

### Summary Unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This s

历史摘要 · 未重新核验 · GitHub Advisory

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The...

CVE-2026-54395

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inse

历史摘要 · 未重新核验 · GitHub Advisory

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The...

CVE-2026-54393

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint pre

历史摘要 · 未重新核验 · GitHub Advisory

MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header...

CVE-2026-54359

MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. W

历史摘要 · 未重新核验 · GitHub Advisory

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag...

CVE-2026-54361

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegatio

历史摘要 · 未重新核验 · GitHub Advisory

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4...

CVE-2026-53408

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.

历史摘要 · 未重新核验 · GitHub Advisory

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4...

CVE-2026-53407

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.

历史摘要 · 未重新核验 · GitHub Advisory

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and...

CVE-2026-50099

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in clearte

历史摘要 · 未重新核验 · GitHub Advisory

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt...

CVE-2026-28742

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmwar

历史摘要 · 未重新核验 · GitHub Advisory

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft...

CVE-2026-10715

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

CVE-2026-54096

### Summary This is similar vulnrability of **`CVE-2026-0035`**, which was fixed in Android `MediaProvider` with **high*

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

CVE-2026-54097

### Summary A low-privileged authenticated user of filebrowser (with `create` + `delete` permissions in their own isolat

历史摘要 · 未重新核验 · GitHub Advisory

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

CVE-2026-44311

### Summary A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-c

历史摘要 · 未重新核验 · GitHub Advisory

Firewall for AI

Firewall for AI

历史摘要 · 未重新核验 · Akamai Security Research

CISA orders feds to patch actively exploited Ivanti flaw by Sunday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploi

历史摘要 · 未重新核验 · BleepingComputer