Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

CVE-2026-46606

### Summary The Glances KVM/QEMU monitoring engine (`glances/plugins/vms/engines/virsh.py`) passes VM domain names, rea

历史摘要 · 未重新核验 · GitHub Advisory

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

CVE-2026-46495

## Summary **Description** A Deserialization of Untrusted Data (CWE-502) issue in OpenDJ's JMX RMI connector allows an

历史摘要 · 未重新核验 · GitHub Advisory

Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types

CVE-2026-44795

### Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when w

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

CVE-2026-44793

## Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied paramete

历史摘要 · 未重新核验 · GitHub Advisory

Paymenter has broken object level authorization via service reference manipulation on ticket creation

CVE-2026-44585

### Summary The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validati

历史摘要 · 未重新核验 · GitHub Advisory

Paymenter doesn't reset email verification status after email change

CVE-2026-44584

### Summary The email update functionality fails to invalidate the existing verification state when a user changes their

历史摘要 · 未重新核验 · GitHub Advisory

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

CVE-2026-44179

### Summary The excerpt-include macro does not properly escape the title of the included page and executes the content o

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM has LDAP Injection via `_queryId` Parameter

CVE-2026-41573

OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilit

历史摘要 · 未重新核验 · GitHub Advisory

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active...

CVE-2026-12249

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Servic

历史摘要 · 未重新核验 · GitHub Advisory

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0...

CVE-2026-8646

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 ar

历史摘要 · 未重新核验 · GitHub Advisory

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and...

CVE-2026-10789

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled

历史摘要 · 未重新核验 · GitHub Advisory

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine...

CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud C

历史摘要 · 未重新核验 · GitHub Advisory

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected...

CVE-2026-7664

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and

历史摘要 · 未重新核验 · GitHub Advisory

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the ...

CVE-2026-12479

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method

历史摘要 · 未重新核验 · GitHub Advisory

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2...

CVE-2023-33854

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow a

历史摘要 · 未重新核验 · GitHub Advisory

AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

CVE-2026-33684

## Summary The `set_api_signUp` method in the API plugin accepts `emailVerified`, `canUpload`, `canStream`, and `canCre

历史摘要 · 未重新核验 · GitHub Advisory

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

CVE-2026-33646

## Summary Mise processes `.tool-versions` files through the Tera template engine during parsing, with the `exec()` fun

历史摘要 · 未重新核验 · GitHub Advisory

OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

CVE-2026-21887

### Summary The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axi

历史摘要 · 未重新核验 · GitHub Advisory

Firewall for AI

Firewall for AI

历史摘要 · 未重新核验 · Akamai Security Research

Firefox browsers

Firefox browsers

历史摘要 · 未重新核验 · Mozilla Security Advisories