o6 Automation open62541 Use After Free
CVE-2026-63035
A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attack
2026-08-01 归档
今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。
← 返回归档列表MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments
CVE-2026-66420
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated
o6 Automation open62541 Integer Overflow or Wraparound
CVE-2026-63559
An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to r
RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath
CVE-2026-64816
RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_proce
AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler
CVE-2026-61526
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through
OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field
CVE-2026-66418
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attack
LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard
CVE-2026-68503
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships def
LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE
CVE-2026-68502
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.
Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
CVE-2026-68501
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
Sylius Mollie Plugin: Payment status forgery via the payment webhook
CVE-2026-68500
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
CVE-2026-68499
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
CVE-2026-67550
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex again
Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
CVE-2026-65835
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
CVE-2026-65834
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMet
Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController
CVE-2026-67207
Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authentic
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
CVE-2026-67206
Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticat
OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure
CVE-2026-67528
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resol
OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"
CVE-2026-67527
OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} acc
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
CVE-2026-66066
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.
CVE-2026-15969
CVE-2026-15969
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denyl