Kirby: Self cross-site scripting (self-XSS) in the writer field
CVE-2026-49276
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any b
2026-07-10 归档
今日共收录 1398 条安全情报，包含 466 个 CVE，522 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Kirby: `pages.access` permission is not checked in the `site/find` REST API route
CVE-2026-54005
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.acce
Kirby: Request header injection in `Http\Remote`
CVE-2026-50188
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Htt
Kirby: Access to files of top-level drafts is not protected by permissions
CVE-2026-54004
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enab
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
CVE-2026-49274
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with role
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
CVE-2026-54003
Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user ac
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
CVE-2026-54002
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
CVE-2026-13492
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
CVE-2026-58198
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrai
Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
CVE-2026-59149
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is
Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
CVE-2026-59148
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/
Discourse: Remote code execution via pdf uploads
CVE-2026-55420
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-
LibreBooking path traversal
CVE-2026-61343
LibreBooking's email template editor save action passes the submitted template name directly into the destination file p
Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
CVE-2026-59817
Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed a
Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution
CVE-2026-59734
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.
Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment
CVE-2026-59726
Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exp
Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
CVE-2026-59720
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.t
Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
CVE-2026-59721
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in ad
apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution
CVE-2026-15195
A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Po
Open WebUI: Arena task endpoints can bypass underlying model access controls
CVE-2026-59225
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an auth