Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
CVE-2026-77608
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
#advisory
共收录 23421 条相关情报。
← 返回所有主题Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
CVE-2026-77606
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
CVE-2026-77301
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEnt
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
CVE-2026-77339
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listen
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
CVE-2026-58197
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to Too
Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
CVE-2026-61795
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnU
spatie Scotty Self Update SelfUpdater.php update code download
CVE-2026-93534
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file ap
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
CVE-2026-61672
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in p
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
CVE-2026-61794
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update valida
btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh
CVE-2026-62943
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_fil
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
CVE-2026-81505
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID}
NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing
CVE-2026-73863
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/pro
NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS
CVE-2026-61633
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supp
NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing
CVE-2026-44639
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c
spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection
CVE-2026-93533
A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivi
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
CVE-2026-61682
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
CVE-2026-54147
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvid
http4k: `DigestAuthProvider.verify` did not bind to request URI
CVE-2026-54148
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvid
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
CVE-2025-61682
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
Mojolicious: CSRF tokens are vulnerable to BREACH attacks
CVE-2026-77568
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, a