Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
CVE-2026-95601
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
2026-09-24 归档
今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored ...
CVE-2026-84502
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not valid
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator u...
CVE-2026-77602
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary Jav...
CVE-2026-96759
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator opt
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals....
CVE-2026-96758
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript...
CVE-2026-96757
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string li
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attacker...
CVE-2026-96755
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attack...
CVE-2026-96754
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape Op
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and userna...
CVE-2026-85724
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, Authorizations
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests
CVE-2025-63564
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK,...
CVE-2026-96276
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak
LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC con...
CVE-2026-96560
LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_t
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager instal...
CVE-2026-86708
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud servi
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently rejec...
CVE-2026-59167
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDE...
CVE-2026-86246
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
CVE-2026-19599
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger re...
CVE-2026-86350
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0...
CVE-2026-86248
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apac
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache T...
CVE-2026-76183
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocke
Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source ta...
CVE-2026-82331
Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildS