OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote
#advisory
共收录 23075 条相关情报。
← 返回所有主题openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
CVE-2026-108551
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an O
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
CVE-2026-108550
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeControll
cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
CVE-2026-108549
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in pla
AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
CVE-2026-108548
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that
AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
CVE-2026-108547
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users t
Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
CVE-2026-108546
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote at
SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
CVE-2026-108545
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attacke
Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses
CVE-2026-108115
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to b
Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route
CVE-2026-108164
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/
Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL
CVE-2026-108162 · CVE-2026-108163
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified
Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For
CVE-2026-108163 · CVE-2026-108162
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to
FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
CVE-2026-108161
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauth
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
CVE-2026-107794
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typema
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
CVE-2026-107373
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringi
Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
CVE-2026-103636
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_uni
Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
CVE-2026-103635
Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). com
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
CVE-2026-103513
Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A c
Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
CVE-2026-103501
Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deseri
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
CVE-2026-107657
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-