Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers
CVE-2026-105293
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Disc
2026-10-06 归档
今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
CVE-2026-105223
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeco
alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer
CVE-2026-105222
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
CVE-2026-105221
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to
Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
CVE-2026-105220
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup fro
devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment
CVE-2026-105165
A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_se
NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds
CVE-2026-105164
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file c
crossplane crossplane-runtime ImageConfig client.go Get toctou
CVE-2026-105163
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts...
CVE-2026-105786
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.1
h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd ...
CVE-2026-21589
h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Cent
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4,...
CVE-2026-105689
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java
A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipul...
CVE-2026-105307
A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filt
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resul...
CVE-2026-104808
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious us
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confir...
CVE-2026-84169
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actua
Rejetto HFS servers now actively scanned for critical RCE flaw
CVE-2026-61500
Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows s
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the ...
CVE-2026-105484
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the functio
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters f...
CVE-2026-105763
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQ
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the ser...
CVE-2026-105740
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflo
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an ...
CVE-2026-105697
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio tra
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask comm...
CVE-2026-105691
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlle