Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the...
CVE-2026-55201
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function
2026-06-18 归档
今日共收录 819 条安全情报，包含 0 个 CVE，417 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header...
CVE-2026-55202
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection,
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI...
CVE-2026-12529
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the...
CVE-2026-10741
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configur
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI...
CVE-2026-10696
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier all
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the...
CVE-2026-53871
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that ac
Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world...
CVE-2026-53870
Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mod
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated...
CVE-2026-11407
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attacker
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session...
CVE-2026-55197
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows aut
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that...
CVE-2026-53869
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export...
CVE-2026-55198
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows a
CakePHP Authentication: Open redirect weakness via backslash bypass
CVE-2026-55590
### Impact The `getLoginRedirect()` method contains a weakness to backslash bypasses allowing redirect targets with atta
Deno: Denial of service via non-ASCII bytes in WebSocket response headers
CVE-2026-55517
## Summary A Deno program that opens a client `WebSocket` connection could be crashed by the remote server. While handl
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
CVE-2026-55471
### Summary `org.hl7.fhir.utilities.XsltUtilities` exposes two parallel families of XSLT transform helpers. The `transf
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
CVE-2026-55470
## Summary The fix for CVE-2026-45367 added `RegexTimeout` protection to the `matches()` function in DSTU2016MAY, DSTU3,
handlebars.java FileTemplateLoader Path Traversal
CVE-2026-55760
### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or Clas
Filament: Disabled RichEditor field state can be used for XSS
CVE-2026-55409
In Filament v3, a disabled `RichEditor` field rendered its raw state without sanitizing HTML. Where the data stored in t
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
CVE-2026-55405
### Summary The MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter **keys**
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for...
CVE-2026-5667
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan);
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI...
CVE-2026-7300
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web In