picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated...
CVE-2026-53874
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbit
2026-06-18 归档
今日共收录 819 条安全情报，包含 0 个 CVE，417 篇安全通告，以及 115 篇研究论文。
← 返回归档列表picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the...
CVE-2026-3490
picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolv
A vulnerability in the browser-based version of Cisco Webex App could have allowed an...
CVE-2026-20178
A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker t
picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to...
CVE-2026-53873
picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level pro
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-54812
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Mot
picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers...
CVE-2025-71321
picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute...
CVE-2026-20181
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote...
CVE-2025-71323
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoki
picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and...
CVE-2025-71320
picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller fun
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when...
CVE-2025-71325
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes
The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 ...
CVE-2026-55743
The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised sec
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-54815
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shi
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-54808
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Trave
Unauthenticated PHP Object Injection in Moderno < 1.43 versions.
CVE-2026-49108
Unauthenticated PHP Object Injection in Moderno < 1.43 versions.
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
CVE-2026-9595
### Impact When a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also
Gitea: Open Redirect via redirect_to
CVE-2026-25779
### Details Despite the validation within `urlIsRelative` in `modules/httplib/url.go`, an open redirect is still possib
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
CVE-2026-22555
## Summary The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` only checks `IsOrgMember()` when a user forks a r
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
CVE-2026-54018
### Summary The SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP ad
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
CVE-2026-54014
## Summary A path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authentica
Firewall for AI
Firewall for AI