obsidian-tc bridge tools expose data outside the read ACL
CVE-2026-77362
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools d
#advisory
共收录 23043 条相关情报。
← 返回所有主题Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
CVE-2026-93347
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
CVE-2026-93346
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers t
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
CVE-2026-74047
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with ag
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
CVE-2026-74045
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from inp
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
CVE-2026-74043
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
CVE-2026-74040
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
CVE-2026-74037
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token
Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
CVE-2026-74036
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by fi
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
CVE-2026-74035
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
CVE-2026-74034
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue
Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
CVE-2026-74033
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB lis
Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
CVE-2026-74032
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated u
Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
CVE-2026-74031
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file h
Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
CVE-2026-74030
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
CVE-2026-109963
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_tem
Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
CVE-2026-109962
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-a
Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
CVE-2026-109961
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject ar
Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to