BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP...
CVE-2026-82450
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that al
#advisory
共收录 23717 条相关情报。
← 返回所有主题Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders...
CVE-2026-82447
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first throu
CVE-2026-82481
CVE-2026-82481
The cohttp package before 6.3.0 for OCaml allows directory traversal.
CVE-2026-82477
CVE-2026-82477
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal netw
su-exec through 0.3 Privilege Escalation via Numeric User ID
CVE-2026-82457
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t an
argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
CVE-2026-82456
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller c
RubyGems before 4.0.13 Path Traversal via Symlink Resolution
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi
Formwork through 2.3.14 Stored XSS via Referer Header
CVE-2026-82451
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1...
CVE-2026-80192
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) con
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions...
CVE-2026-14494
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an...
CVE-2026-82364
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file
Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrep
Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock
CVE-2026-82447
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first throu
macrozheng mall Order Submission submit race condition
CVE-2026-82364
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file
In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate...
CVE-2026-80725
In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation cri
net: gro: properly validate BIG TCP aggregation criteria
CVE-2026-80725
In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation cri
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of...
CVE-2026-77012
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated end
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability...
CVE-2026-81346
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict...
CVE-2026-81200
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order informa
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being...
CVE-2026-76547
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when impor