LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
CVE-2026-84194
LibreNMS versions >= 23.10.0 and getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/dom
2026-09-02 归档
今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。
← 返回归档列表LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
CVE-2026-84193
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render un
LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sou
LibreNMS before 26.5.0 Remote Code Execution via AboutController
CVE-2026-84190
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget c
LibreNMS before 26.7.0 Stored XSS via Oxidized API
CVE-2026-84189
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable
AVideo on_publish.php Missing Authentication Check via RTMP Callback
CVE-2026-84187
AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attacke
Kyverno before v1.13.4 SSRF via Service Call
CVE-2025-15613
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attack
Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites
CVE-2023-54356
Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_
invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization
CVE-2026-83743
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /ve
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
CVE-2026-82749
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match uni
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
CVE-2026-82748
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing i
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
CVE-2026-82746
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
CVE-2026-82745
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS
Ash.Reactor change step fails open, skipping a change when its where guard raises
CVE-2026-82744
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controll
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82743
Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread
Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82741
Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type
Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82740
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nest
Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
CVE-2026-82739
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value
Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
CVE-2026-82738
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by
Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
CVE-2026-82737
Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later