LibreNMS before 26.9.0 Stored XSS via wireless sensor description
CVE-2026-109352
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.p
2026-10-13 归档
今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。
← 返回归档列表Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count
CVE-2026-109351
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to
Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance
CVE-2026-109350
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
CVE-2026-109349
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header d
Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing
CVE-2026-109348
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU throu
Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
CVE-2026-109347
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATT
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
CVE-2026-109346
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization
DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
CVE-2026-109345
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization becau
DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
CVE-2026-109344
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutral
Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport
CVE-2026-109332
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-
Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget
CVE-2026-109331
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
CVE-2026-109330
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows re
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role adm
Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name
CVE-2026-109328
Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresent
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php
CVE-2026-109327
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/
Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization
CVE-2026-109323
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitor
Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
CVE-2026-109321
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a d
Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
CVE-2026-109319
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in A
Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author
CVE-2026-109318
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors
Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to