JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation
CVE-2026-104126
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts,
2026-10-14 归档
今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。
← 返回归档列表OpenCATS: Authenticated RCE in the Import module
CVE-2026-54454
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
CVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3
FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
CVE-2026-85733
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker ima
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
CVE-2026-82416
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state
RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page
CVE-2026-55183
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.
Cronicle: Stored XSS in admin Activity Log via account full_name field
CVE-2026-55562
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
CVE-2026-54641
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealm
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
CVE-2026-54640
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in ag
ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing
CVE-2026-54697
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readL
ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation
CVE-2026-54700
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protoco
Electron: Local race condition in Squirrel.Mac update installation on macOS
CVE-2026-102672
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
CVE-2026-49265
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKC
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
CVE-2026-103928
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
CVE-2026-110025
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file in
Plane: Unauthenticated Workspace Invitation Token Leakage
CVE-2026-102981
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET
Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
CVE-2026-102988
Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthentic
HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
CVE-2026-109526
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component e
asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
CVE-2026-102734
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the
KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
CVE-2026-69150
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-bet