LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sou
#advisory
共收录 23717 条相关情报。
← 返回所有主题LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
CVE-2026-84191
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescrip
LibreNMS before 26.5.0 Remote Code Execution via AboutController
CVE-2026-84190
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget c
LibreNMS before 26.7.0 Stored XSS via Oxidized API
CVE-2026-84189
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable
librenms before 26.7.0 Stored XSS via graph_descr settings
CVE-2026-84188
LibreNMS versions configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs
AVideo on_publish.php Missing Authentication Check via RTMP Callback
CVE-2026-84187
AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attacke
AVideo Cross-Site Request Forgery via plugin/API/set.json.php
CVE-2026-83595
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform s
Kyverno before v1.13.4 SSRF via Service Call
CVE-2025-15613
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attack
Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites
CVE-2023-54356
Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_
【大模型服务平台 TokenHub】服务条款更新及《第三方部署模型服务特别说明》上线通知
【大模型服务平台 TokenHub】服务条款更新及《第三方部署模型服务特别说明》上线通知
【TDSQL-C MySQL 版】数据库故障隐患规避公告
【TDSQL-C MySQL 版】数据库故障隐患规避公告
invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization
CVE-2026-83743
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /ve
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82747
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
CVE-2026-82749
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match uni
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
CVE-2026-82748
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing i
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
CVE-2026-82746
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
CVE-2026-82745
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS
Ash.Reactor change step fails open, skipping a change when its where guard raises
CVE-2026-82744
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controll
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82743
Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread
Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
CVE-2026-82742
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a fi