Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts att...

CVE-2026-48105

CVE-2026-48105 影响 Arc Enterprise（Arc 是一个开源的、SQL 原生时序数据库，用于遥测数据）。在版本 26.06.1 之前，Arc Enterprise 的 Raft 状态机（FSM）在 `internal

历史摘要 · 未重新核验 · NVD

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` i...

CVE-2026-48050

CVE-2026-48050 涉及 Arc 时间序列数据库（一个面向遥测数据的 SQL 原生时序数据库）中的一个安全漏洞。在 26.06.1 之前的版本中，Arc 在 internal/api/server.go 中通过 app.Use(p

历史摘要 · 未重新核验 · NVD

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read...

CVE-2026-47735

CVE-2026-47735 是 Arc 时间序列数据库中一个严重的输入验证绕过漏洞。Arc 允许用户执行 SQL 查询，但其验证机制存在缺陷：仅使用简单的正则表达式黑名单阻止了 `read_parquet(` 和 `arc_partiti

历史摘要 · 未重新核验 · NVD

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior...

CVE-2026-69236

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote,

历史摘要 · 未重新核验 · GitHub Advisory

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior...

CVE-2026-69232

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

历史摘要 · 未重新核验 · GitHub Advisory

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior...

CVE-2026-69235

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

历史摘要 · 未重新核验 · GitHub Advisory

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior...

CVE-2026-69230

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

历史摘要 · 未重新核验 · GitHub Advisory

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5...

CVE-2026-69234

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allo

历史摘要 · 未重新核验 · GitHub Advisory

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior...

CVE-2026-69231

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

历史摘要 · 未重新核验 · GitHub Advisory

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior...

CVE-2026-69233

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

历史摘要 · 未重新核验 · GitHub Advisory

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sens

历史摘要 · 未重新核验 · GitHub Advisory

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

CVE-2026-63135

### Summary YOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domai

历史摘要 · 未重新核验 · GitHub Advisory

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

CVE-2026-61539

### Summary Xinference used Python's unsafe `eval()` function when parsing Llama3 tool-call output generated by a large

历史摘要 · 未重新核验 · GitHub Advisory

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

CVE-2026-76904

### Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementat

历史摘要 · 未重新核验 · GitHub Advisory

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request h...

CVE-2026-63004

## Summary Unleash's addon/integration subsystem lets an operator configure a webhook (and the Slack, Microsoft Teams,

历史摘要 · 未重新核验 · GitHub Advisory

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows...

CVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege att

历史摘要 · 未重新核验 · GitHub Advisory

Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to...

CVE-2026-69502

Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a ne

历史摘要 · 未重新核验 · GitHub Advisory

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing...

CVE-2026-77087

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbit

历史摘要 · 未重新核验 · GitHub Advisory

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows...

CVE-2026-15580

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This

历史摘要 · 未重新核验 · GitHub Advisory

Firefox browsers

Firefox browsers

历史摘要 · 未重新核验 · Mozilla Security Advisories