Apache Fineract: SQL injection in runreports endpoint
CVE-2026-35152
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to a
2026-07-16 归档
今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
CVE-2026-56287
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versi
CVE-2026-61371
CVE-2026-61371
Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/
mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal
CVE-2026-15751
A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is th
jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run
CVE-2026-54684
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlle
jadx: HTML Injection in Summary panel
CVE-2026-42447
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary
Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
CVE-2026-50130
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From
`jwt` (Ruby gem) - empty-key HMAC bypass
CVE-2026-45363
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(t
mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
CVE-2026-15750
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of t
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
CVE-2026-48807
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable val
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
CVE-2026-48806
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerc
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
CVE-2026-48808
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
CVE-2026-48805
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forw
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
CVE-2026-49981
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is c
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
CVE-2026-46637
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra a
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
CVE-2026-46638
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previou
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
CVE-2026-46640
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.() and import-alias dynamic attribute syntax can co
Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
CVE-2026-46629
Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter ins
Twig: The `spaceless` filter implicitly marks its output as safe
CVE-2026-46628
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, ca
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
CVE-2026-46634
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a