spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest...
CVE-2026-100867
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi
#advisory
共收录 23312 条相关情报。
← 返回所有主题navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them...
CVE-2026-101032
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta
onefetch through 2.28.1 writes repository information field values to the terminal without...
CVE-2026-100866
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters,
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password...
CVE-2026-100870
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r
Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover
CVE-2026-101041
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check
KitchenOwl through 0.7.10 IDOR via unchecked category ID
CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati
navi through 2.24.0 OS Command Injection via Cheatsheet Variables
CVE-2026-101032
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
CVE-2026-100872
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthentic
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
CVE-2026-100871
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT token
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
CVE-2026-100870
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
CVE-2026-100869
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
CVE-2026-100868
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si
spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection
CVE-2026-100867
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi
onefetch through 2.28.1 Terminal Escape Sequence Injection
CVE-2026-100866
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters,
When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or...
CVE-2026-94417
When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL ski
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in...
CVE-2026-97164
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due...
CVE-2026-100747
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF toke
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
CVE-2026-100748
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6...
CVE-2026-97165
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” par
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6...
CVE-2026-100749
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned fi