Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
CVE-2026-55675
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb
#advisory
共收录 23043 条相关情报。
← 返回所有主题girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
CVE-2026-109525
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
heym Python Tool Sandbox Escape
CVE-2026-55376
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an
ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
CVE-2026-81507
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc
girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
CVE-2026-109524
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
CVE-2026-106108
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/ap
SFTPGo source-side file-pattern filter bypass during copy operations
CVE-2026-103028
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy p
SFTPGo: Denial of service via malformed SSH channel request
CVE-2026-77375
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malf
girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection
CVE-2026-109523
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d
DragonflyDB stream RDB deserialization double-free
CVE-2026-104192
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStrea
MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
CVE-2026-53711
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts fe
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
CVE-2026-53709
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example s
girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection
CVE-2026-109522
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
ammonia allows stored XSS through unsanitized SVG animate and set attributes
CVE-2026-102342
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that
Gotify: Insufficiently Protected Password Change endpoint
CVE-2026-102603
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the pass
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
CVE-2026-107460
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-shee
girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection
CVE-2026-109521
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999
obsidian-tc symlink path mismatch bypasses read ACL restrictions
CVE-2026-77361
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-co
yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
CVE-2026-109967
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method tha
yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method
CVE-2026-109966
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to