In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold...

CVE-2026-76353

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role...

CVE-2026-76350

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_searc

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold...

CVE-2026-76352

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk...

CVE-2026-76348

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can...

CVE-2026-76345

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head cluster

历史摘要 · 未重新核验 · GitHub Advisory

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

CVE-2026-63123

### Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to ca

历史摘要 · 未重新核验 · GitHub Advisory

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

CVE-2026-59992

## Summary The production media handler shipped by `next-tinacms-s3` (`createMediaHandler` in `packages/next-tinacms-s3

历史摘要 · 未重新核验 · GitHub Advisory

logto-tunnel serves files outside --experience-path via path traversal

CVE-2026-63188

### Summary `@logto/tunnel` serves custom sign-in experience files from the `--experience-path` directory. When the tun

历史摘要 · 未重新核验 · GitHub Advisory

BuildKit has a possible runtime DoS via unbounded group parsing

CVE-2026-61712

### Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a contai

历史摘要 · 未重新核验 · GitHub Advisory

BuildKit: Custom frontend could bypass Seccomp/AppArmor

CVE-2026-61711

### Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the b

历史摘要 · 未重新核验 · GitHub Advisory

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

### Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the `SEARXNG_URL` e

历史摘要 · 未重新核验 · GitHub Advisory

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

CVE-2026-62673

## Summary The default `.htaccess` shipped with Grav (and the reference `webserver-configs/htaccess.txt`) contains secu

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT: Stored DOM XSS via table selected-count IDs

CVE-2026-61807

### Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and suppli

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

CVE-2026-55703

### Impact Any activated account in a company can read every maintenance record for that company (asset tag, supplier, p

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

CVE-2026-55694

### Impact An attacker can completely bypass file-name randomization security and without authorization download confide

历史摘要 · 未重新核验 · GitHub Advisory

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

CVE-2024-45747

### Summary A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to up

历史摘要 · 未重新核验 · GitHub Advisory

SearXNG MCP Server: Additional hardened-mode SSRF bypasses

CVE-2026-54689

## Summary `mcp-searxng` has a hardened-mode URL-reading feature intended to prevent `web_url_read` from reaching priva

历史摘要 · 未重新核验 · GitHub Advisory

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

CVE-2026-54688

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87#issuecomment-4645453694 ### Summary The web_url_read tool

历史摘要 · 未重新核验 · GitHub Advisory

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain

历史摘要 · 未重新核验 · GitHub Advisory

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

CVE-2026-53966

### Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that

历史摘要 · 未重新核验 · GitHub Advisory