Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
CVE-2026-83597
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches
2026-09-23 归档
今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。
← 返回归档列表Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
CVE-2026-83600
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART
Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
CVE-2026-83598
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powe
Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
CVE-2026-83603
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-sta
Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
CVE-2026-83601
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENS
Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
CVE-2026-83602
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api
Netdata: WebSocket Decompression Bomb
CVE-2026-83599
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates per
AT_SECURE program buffer overflow via $ORIGIN processing
CVE-2026-95818
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allo
Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
CVE-2026-76805
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path
Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
CVE-2026-76802
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading b
Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
CVE-2026-76804
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loadi
Nuclei: Local File Read via MySQL Client Sandbox Bypass
CVE-2026-76803
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript
Sentry: Unsafe pickle deserialization in Relocation Feature
CVE-2026-83803
Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the reloca
LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
CVE-2026-86062
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieva
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
CVE-2026-94455
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The a
LightRAG: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-85725
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwo
LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
CVE-2026-85709
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Py
Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one
CVE-2026-86059
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Gi
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
CVE-2026-94456
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The
AT_SECURE programs may load attacker-controlled code via $ORIGIN
CVE-2026-86805
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versio