OpenReception: Staff deletion removes pending invites cross-tenant by email match
CVE-2026-48074
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
2026-08-08 归档
今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Silverstripe: XSS in breadcrumbs in page list view
CVE-2026-54717
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable
Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
CVE-2026-63637
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.
WGDashboard Server-Side Template Injection vulnerability
CVE-2026-15734
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated att
WGDashboard Remote Code Execution vulnerability
CVE-2026-15733
A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injectio
WGDashboard Server-Side Request Forgery Vulnerability
CVE-2026-15732
A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functiona
Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll
CVE-2026-70559
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation t
Decidim: CSV census record endpoints improper authorization
CVE-2026-45415
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3
Decidim: JWT-backed authentication can be replayed across organizations
CVE-2026-45414
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API auth
diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts
CVE-2026-70557
diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
CVE-2026-71433
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoin
GitHub CLI: Terminal escape sequence injection in multiple `gh` commands
CVE-2026-64654
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed ex
OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment
CVE-2026-48080
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
Insecure direct object reference in Strands Agents Tools memory tool namespace isolation
CVE-2026-19111
Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Ag
GitHub CLI: Unescaped variable components in request URLs could allow path traversal
CVE-2026-64653
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable pat
GitHub CLI: Partial token disclosure in `gh auth status` output
CVE-2026-64652
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characte
x86/bugs: Make Safe-RET robust against interrupt injection
CVE-2026-68480
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt in
sysPass FileBackupService Authenticated OS Command Injection via Backup Path
CVE-2026-63725
sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a ta
Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
CVE-2026-19127
An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflo
TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index
CVE-2026-70635
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authentica