A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects...
CVE-2026-100880
A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the fi
2026-09-28 归档
今日共收录 884 条安全情报，包含 147 个 CVE，402 篇安全通告，以及 73 篇研究论文。
← 返回归档列表A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is...
CVE-2026-100878
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.is
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the...
CVE-2026-100879
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed o
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1...
CVE-2026-101063
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authen
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI...
CVE-2026-101059
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attacker
utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP...
CVE-2026-101057
utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a cal
Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask...
CVE-2026-101045
Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests gen
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET ...
CVE-2026-101046
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a...
CVE-2026-101058
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manu
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0...
CVE-2026-101044
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable...
CVE-2026-101043
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the htt
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook...
CVE-2026-101050
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credent
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential...
CVE-2026-101049
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in...
CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest...
CVE-2026-100867
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them...
CVE-2026-101032
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta
onefetch through 2.28.1 writes repository information field values to the terminal without...
CVE-2026-100866
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters,
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password...
CVE-2026-100870
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in...
CVE-2026-97164
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due...
CVE-2026-100747
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF toke