heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map...
CVE-2026-100864
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback re
#advisory
共收录 23334 条相关情报。
← 返回所有主题Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition...
CVE-2026-100865
Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition evaluator uses Python eval(
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials...
CVE-2026-100859
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that all
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote...
CVE-2026-100848
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syn
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai...
CVE-2026-100844
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_run
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station...
CVE-2026-100855
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability...
CVE-2026-100850
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote pl
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password...
CVE-2026-100856
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete mig
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint...
CVE-2026-100854
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derive
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level...
CVE-2026-100853
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allow
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of...
CVE-2026-100847
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListA
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the...
CVE-2026-100846
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config...
CVE-2026-100852
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recordi
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station...
CVE-2026-100849
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/...
CVE-2026-100851
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter:...
CVE-2026-100857
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails t
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per...
CVE-2026-100837
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail...
CVE-2026-100833
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all containe
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any...
CVE-2026-100835
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's...
CVE-2026-100836
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSO