fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
CVE-2026-104851
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fssp
2026-10-03 归档
今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Tinypool: Prototype Pollution Gadget to RCE in run() options
CVE-2026-104849
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-s
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
CVE-2026-104848
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
CVE-2026-103648
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded respons
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
CVE-2026-104844
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, s
uv: Path traversal on Windows through wheel extraction
CVE-2026-104843
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows ca
xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
CVE-2026-94422
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass th
YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
CVE-2026-104473
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inj
YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
CVE-2026-104472
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unaut
YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
CVE-2026-104471
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote
YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
CVE-2026-104469
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions be
YesWiki before 4.6.7 Authorization Bypass via Public API Mode
CVE-2026-104467
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenti
YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
CVE-2026-104462
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unesca
YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
CVE-2026-104461
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only t
YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
CVE-2026-104460
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list opt
YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
CVE-2026-104459
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticate
YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filte
YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
CVE-2026-104456
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a st
YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
CVE-2026-104455
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restr
YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) ma