DataEase: Hardcoded JWT Signing Secret in ShareLink
CVE-2026-57172
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded de
2026-07-09 归档
今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。
← 返回归档列表NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper
CVE-2026-58468
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows au
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by acce...
CVE-2026-59705
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registerin...
CVE-2026-58473
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute...
CVE-2026-52200
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-58525
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of...
CVE-2026-0288
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-
ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)
CVE-2026-53531
### Summary RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\lef
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics...
CVE-2026-47646
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allo
Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote...
CVE-2026-15113
Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote attacker to potentially
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to...
CVE-2026-15115
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the...
CVE-2026-60105
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an
GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19...
CVE-2026-6896
GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7,...
CVE-2026-13320
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that...
CVE-2026-59806
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to re
An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to...
CVE-2026-36027
An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via
A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical...
CVE-2026-36028
A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
CVE-2026-49471
### Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 2428