JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
2026-10-14 归档
今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
CVE-2026-55675
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
CVE-2026-109525
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
heym Python Tool Sandbox Escape
CVE-2026-55376
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an
ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
CVE-2026-81507
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc
girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
CVE-2026-109524
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
CVE-2026-106108
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/ap
SFTPGo source-side file-pattern filter bypass during copy operations
CVE-2026-103028
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy p
SFTPGo: Denial of service via malformed SSH channel request
CVE-2026-77375
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malf
girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection
CVE-2026-109523
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d
girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection
CVE-2026-109522
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
ammonia allows stored XSS through unsanitized SVG animate and set attributes
CVE-2026-102342
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
CVE-2026-107460
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-shee
girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection
CVE-2026-109521
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999
obsidian-tc symlink path mismatch bypasses read ACL restrictions
CVE-2026-77361
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-co
yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
CVE-2026-109967
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method tha
yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method
CVE-2026-109966
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to
obsidian-tc bridge tools expose data outside the read ACL
CVE-2026-77362
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools d
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
CVE-2026-93347
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
CVE-2026-93346
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers t