Froxlor before 2.3.12 Credential Disclosure via DirProtections API
CVE-2026-100719
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t
#advisory
共收录 23334 条相关情报。
← 返回所有主题Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
CVE-2026-100718
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
CVE-2026-100717
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return
Froxlor before 2.3.12 Privilege Escalation via Symlink
CVE-2026-100716
Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails
Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
CVE-2026-100715
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task
Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
CVE-2026-100714
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings h
Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
CVE-2026-100713
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cr
froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
CVE-2026-100712
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET r
froxlor before 2.3.12 Authentication Bypass via Session Persistence
CVE-2026-100711
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user p
Froxlor before 2.3.12 DKIM Private Key Disclosure via API
CVE-2026-100710
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma
Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Froxlor before 2.3.13 Private Key Disclosure via Certificates API
CVE-2026-100708
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t
Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
CVE-2026-100707
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources
kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace
Kyverno before 1.19.1 SSRF via legacy apiCall service executor
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.2
Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyvern
Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
CVE-2026-100703
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
CVE-2026-100702
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, all
Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
CVE-2026-100701
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each c
nodemailer before 10.0.6 Denial of Service via addressparser
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex patter