Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib...
CVE-2026-38974
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.
2026-07-16 归档
今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function...
CVE-2026-15907
A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3...
CVE-2026-26718
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an att
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to...
CVE-2026-38754
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Serv
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation...
CVE-2026-30623
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows...
CVE-2026-38752
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute...
CVE-2026-26719
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a cra
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a...
CVE-2025-65720
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server...
CVE-2026-30618
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the...
CVE-2026-36590
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
CVE-2026-54504
### Summary `@andrea9293/mcp-documentation-server` v1.13.0 documents that a Web UI starts automatically on port `3080`.
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
CVE-2026-50289
### Summary On Linux, `systeminformation`'s `networkInterfaces()` is vulnerable to OS command injection through the Deb
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50276
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50274
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50273
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50272
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50271
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50270
### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without
ViewComponent: around_render HTML-Safety Bypass
CVE-2026-54498
## Summary `ViewComponent::Base#around_render` can return HTML-unsafe strings that bypass the escaping behavior applied
open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters
CVE-2026-54495
## Summary A namespaced `FeatureFlagSource` or `InProcessConfiguration` resource can be referenced cross-namespace via