oclif JIT Plugin Entry child_process.exec os command injection
CVE-2026-16628
A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec o
2026-07-23 归档
今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。
← 返回归档列表OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify
CVE-2026-13089
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorith
Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
CVE-2026-64829
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obta
CVE-2026-16624
CVE-2026-16624
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on
CVE-2026-65650
CVE-2026-65650
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service
CVE-2026-7328
Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CM
Onlook tRPC Insecure Direct Object Reference via multiple procedures
CVE-2026-65013
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows a
InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder
CVE-2026-65012
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_fo
Graylog2 Server Missing Permission Check on Event Definition Duplicate
CVE-2026-65011
Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{de
libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
CVE-2026-48029
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in Image
ReDoS in Open Mercato
CVE-2026-16270
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex
Denial-of-Service in OpenCanary's MongoDB module
CVE-2026-16551
Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affe
Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex
CVE-2026-65600
Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex
n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
CVE-2026-65597
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the
n8n before 1.123.64 Credential Exfiltration via GraphQL Node
CVE-2026-65596
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based cr
n8n before 2.30.1 Missing OAuth Authorization Check
CVE-2026-65594
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was
n8n before 1.123.64 SSRF via Dynamic Node Parameters
CVE-2026-65593
n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoint
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
CVE-2026-65591
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authentic
n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
CVE-2026-65590
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/
n8n before 1.123.64 Credential Exposure via LLM Node Execution Data
CVE-2026-65589
n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writin