facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing...
CVE-2026-84702
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs
#advisory
共收录 23717 条相关情报。
← 返回所有主题ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv...
CVE-2026-84484
ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthe
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing...
CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept
A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool...
CVE-2026-84425
A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tool
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands...
CVE-2026-84694
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on man
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function...
CVE-2026-84427
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability...
CVE-2026-84430
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique...
CVE-2026-84696
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA in
Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction
CVE-2026-19754
Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated use
FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update
CVE-2026-84715
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint
CVE-2026-84485
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing
facefusion before 3.7.0 Path Traversal via Job Identifier
CVE-2026-84702
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs
NocoBase Rich Text Field Stored Cross-Site Scripting via API
CVE-2026-84701
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store
Pika Unauthenticated Replication Access via Internal Protobuf Port
CVE-2026-84700
PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
CVE-2026-84697
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/614
BookStack before 26.05.4 Stored XSS via Drawing Upload
CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept
Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
CVE-2026-84694
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on man
UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote...
CVE-2026-84356
UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address ba
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote...
CVE-2026-84357
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who...
CVE-2026-84359
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rende