CVE-2026-38093
CVE-2026-38093
file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22
#advisory
共收录 23717 条相关情报。
← 返回所有主题aiosmtplib: STARTTLS response injection
CVE-2026-55558
## Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately
Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
CVE-2026-61802
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
CVE-2026-61800
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
CVE-2026-61783
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh agent enrollment NULL pointer dereference via malformed manager response
CVE-2026-54084
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh: Missing input validation in multiple active response scripts allows argument injection
CVE-2026-54085
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
CVE-2026-54083
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. T
cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
CVE-2026-77358
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client
cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
CVE-2026-77341
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
CVE-2026-54770
## Summary This is a third follow-up to **CVE-2024-42353 / GHSA-mg3v-6m49-jhp3** and **CVE-2026-44889 / GHSA-fh3h-vg37-
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
CVE-2026-54330
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
CVE-2026-50152
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
Ceph: CephX AES Authentication error
CVE-2026-39944
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
CVE-2025-30156
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
OS Command Injection in PayRange API
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HT
FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
CVE-2026-68929
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, th
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers with
Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
CVE-2026-81729
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
CVE-2026-81728
Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with