ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker could...

CVE-2026-9181

ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker could exploit this issue by sen

历史摘要 · 未重新核验 · GitHub Advisory

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series...

CVE-2026-13753

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmwa

历史摘要 · 未重新核验 · GitHub Advisory

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

CVE-2026-54724

### Summary An open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to c

历史摘要 · 未重新核验 · GitHub Advisory

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

CVE-2026-55438

### Summary Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a worksp

历史摘要 · 未重新核验 · GitHub Advisory

Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command

CVE-2026-55426

### Summary When a check plugin places user provided input inside a command which is passed to `shell_exec`, an attacker

历史摘要 · 未重新核验 · GitHub Advisory

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

CVE-2026-55430

### Summary The workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded

历史摘要 · 未重新核验 · GitHub Advisory

OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

CVE-2026-54640

### Summary The fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler (`KN

历史摘要 · 未重新核验 · GitHub Advisory

OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

CVE-2026-54641

### Summary A realm admin of tenant B can read the profile, client roles, and realm roles of any user in any other real

历史摘要 · 未重新核验 · GitHub Advisory

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

CVE-2026-53624

### Summary The `helmet` middleware in gofiber/fiber never sets the `Strict-Transport-Security` (HSTS) response header,

历史摘要 · 未重新核验 · GitHub Advisory

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

CVE-2026-54769

### Advisory Details **Title**: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatA

历史摘要 · 未重新核验 · GitHub Advisory

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

CVE-2026-54637

## Summary The Dragonfly **scheduler**'s v1 gRPC service contains an unauthenticated Server-Side Request Forgery (SSRF)

历史摘要 · 未重新核验 · GitHub Advisory

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

CVE-2026-53759

### Summary The SQLite databases are created at predictable (static) paths in `/tmp`. Any user can therefore create a sy

历史摘要 · 未重新核验 · GitHub Advisory

Decompress: Archive extraction can create files and links outside of the target directory

CVE-2026-53486

### Impact When extracting an archive to a directory, a crafted archive can read or write files outside that directory.

历史摘要 · 未重新核验 · GitHub Advisory

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to...

CVE-2026-48614

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configurat

历史摘要 · 未重新核验 · GitHub Advisory

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation...

CVE-2026-48316

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could re

历史摘要 · 未重新核验 · GitHub Advisory

An authentication bypass vulnerability exists in the default SFTP server component utilized...

CVE-2026-5268

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products li

历史摘要 · 未重新核验 · GitHub Advisory

Firewall for AI

Firewall for AI

历史摘要 · 未重新核验 · Akamai Security Research

Firefox browsers

Firefox browsers

历史摘要 · 未重新核验 · Mozilla Security Advisories

Sign in to Cloud

Sign in to Cloud

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Sign Up for Free Cloud Tier

Sign Up for Free Cloud Tier

历史摘要 · 未重新核验 · Oracle Critical Patch Updates