Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
CVE-2026-48996
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on
2026-08-28 归档
今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表libreoffice-convert: path traversal / arbitrary file write
CVE-2026-54732
libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js u
Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template
CVE-2026-54718
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an
Silverstripe UserForms: Remote code execution via userforms email subject
CVE-2026-54721
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1
Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
CVE-2026-47727
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe impor
Doggo vulnerable to cross-site scripting via unescaped date field values
CVE-2026-66353
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allow
CVE-2026-79720
CVE-2026-79720
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hid
CVE-2026-79719
CVE-2026-79719
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hid
CVE-2026-79718
CVE-2026-79718
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hid
Authenticated RCE through Twig sandbox escape
CVE-2026-79988
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading t
wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length
CVE-2026-71402
An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capt
wicked: integer underflow of the UDP length in ni_capture_inspect_udp_header() leads to an out-of-bounds read
CVE-2026-71401
An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/captu
UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
CVE-2026-81735
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was g
NLTK before 3.10.3 Hardlink File Overwrite via downloader
CVE-2026-81727
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloa
NLTK through 3.10.3 Path Traversal via Model-Artifact APIs
CVE-2026-81726
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by us
NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader
CVE-2026-81725
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attac
NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
CVE-2026-81724
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unau
NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
CVE-2026-81723
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that
nltk PorterStemmer before 3.10.3 Quadratic-time DoS
CVE-2026-81722
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of serv
openssl_encrypt before 1.4.9 Denial of Service via KDF
CVE-2026-81721
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allo