KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
CVE-2026-62371
## Impact The KubeEdge NodeUpgradeJob handler constructed the `keadm upgrade edge` command by concatenating the user-co
#advisory
共收录 23334 条相关情报。
← 返回所有主题KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
CVE-2026-62370
## Summary KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
CVE-2026-62369
## Description KubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction fun
OpenBao Skips Stricter Deny Policy for LIST operations
CVE-2026-63131
## Impact When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
CVE-2026-62985
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior
psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry
CVE-2026-59991
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDI
mppx: Gas Draining with access list
CVE-2026-63628
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/
mppx: Gas Draining with padding
CVE-2026-63627
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-p
Home Assistant: mDNS Server-Side Request Forgery
CVE-2026-91129
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP
Home Assistant: XSS in Statistics Graph Card
CVE-2026-91130
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Stat
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
CVE-2026-57149
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of po
js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input
CVE-2026-63386
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recurs
icalendar: Denial of service via unbounded VALARM REPEAT expansion
CVE-2026-77399
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.fro
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
CVE-2026-94462
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/st
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
CVE-2026-77246
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an
MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport
CVE-2026-77248
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th
MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
CVE-2026-77256
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th
MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup
CVE-2026-77249
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
CVE-2026-77259
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, co
MCP Atlassian: Insecure File Permissions on OAuth Token Storage
CVE-2026-77268
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th