DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
CVE-2026-49832
DSpace open source software is a repository application which provides durable access to digital resources. From version
#advisory
共收录 23717 条相关情报。
← 返回所有主题LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
CVE-2026-84377
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.
DSpace: Path Traversal possible in LDN message generation
CVE-2026-49833
DSpace open source software is a repository application which provides durable access to digital resources. From version
DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)
CVE-2026-49831
DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver
DSpace: ORE resource URI does not validate scheme for non-web resources
CVE-2026-49830
DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver
agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
CVE-2026-84811
agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to
claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan
CVE-2026-84810
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md wh
Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode
CVE-2026-84809
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pyca
Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
CVE-2026-52831
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio control
Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
CVE-2026-79756
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauth
Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)
CVE-2026-79755
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio loca
Nuclio: Kaniko build tempDir command injection
CVE-2026-79754
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
CVE-2026-52833
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runt
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
CVE-2026-52832
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard e
TOON: Prototype pollution when decoding untrusted TOON input
CVE-2026-82404
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controll
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
CVE-2026-84376
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path fro
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
CVE-2026-45730
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnera
async-tar PAX extension-header desync enables tar entry/content smuggling
CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffe
Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation
CVE-2026-53611
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
CVE-2026-75931
### Impact `fast-uri` canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When `reso