MariaDB: `qc_info` plugin can do OOB reads if query contains \0
CVE-2026-107816
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
2026-10-10 归档
今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
CVE-2026-55797
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3
MariaDB: one byte OOB write in DOS tables of the CONNECT engine
CVE-2026-107815
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed
CVE-2026-108160
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers
AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge
CVE-2026-108159
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that
plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert
CVE-2026-108158
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows
Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
CVE-2026-108157
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthent
LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json
CVE-2026-108156
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC h
MariaDB: Insecure $HOME in MariaDB rpm packages
CVE-2026-107814
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
CVE-2026-107812
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates
Insertion of sensitive information into log file in AWS Tools for PowerShell
CVE-2026-107783
Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to r
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
CVE-2026-107811
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can acce
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
CVE-2026-107810
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts i
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
CVE-2026-107808
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but
ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import
CVE-2026-108113
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handl
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
CVE-2026-108112
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete ot
MOVO through 0.2.3 Authorization Bypass via Document Endpoints
CVE-2026-108110
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authent
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-107806
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with a
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication pat
Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile
CVE-2026-95702
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacke