Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-28151
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
2026-08-25 归档
今日共收录 1135 条安全情报，包含 329 个 CVE，404 篇安全通告，以及 111 篇研究论文。
← 返回归档列表Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and...
CVE-2026-78337
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 al
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registrat...
CVE-2026-78245
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the fi
A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipul...
CVE-2026-78244
A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown f
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the schem...
CVE-2026-76172
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never
Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receivin...
CVE-2026-59295
Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory un
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attr...
CVE-2026-10618
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendere
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/securi...
CVE-2026-10582
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
CVE-2026-78317
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
CVE-2026-78316
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
CVE-2026-78315
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
CVE-2026-78314
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be ...
CVE-2026-75975
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host pre...
CVE-2026-75931
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, ...
CVE-2026-75899
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parse
Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in the 6Storage Rentals WordPress plugin....
CVE-2026-16249
Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the sam
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exha...
CVE-2026-78321
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An atta
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the...
CVE-2026-78306
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth rang
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictab...
CVE-2026-78255
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authentic
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to t...
CVE-2026-77994
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Build