rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
CVE-2026-53788
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allow
#advisory
共收录 23530 条相关情报。
← 返回所有主题Probo has an open redirect bypass via path normalization
CVE-2026-49820
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo
rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
CVE-2026-53798
rsync tbefore 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that a
rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive
CVE-2026-53786
rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-leve
rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
CVE-2026-53783
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricte
rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
CVE-2026-53803
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files b
rsync < 3.5.0 Arbitrary File Read via Symlink Following
CVE-2026-53802
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the r
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
The optional dashboard HTTP server (`atomic_agents/dashboard/serve.py`) builds filesystem paths directly from the reques
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
CVE-2026-54249
### Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the a
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
CVE-2026-54526
### Summary The allow-list fix for CVE-2026-31892 (GHSA-3wf5-g532-rcrr), and its follow-up coverage of `hostNetwork`/`s
hashi-vault-js: Vault token and secret values exposed in thrown errors
CVE-2026-55102
## Summary Vault token and secret values are exposed in thrown errors when using `hashi-vault-js`. ## Details Every A
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
CVE-2026-55088
Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext autho
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
CVE-2026-55086
## Description `src/node/handler/ImportHandler.ts` and `src/node/handler/ExportHandler.ts` both compute their temporary
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
CVE-2026-55087
# GHSA-03 — `x-proxy-path` header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
CVE-2026-55072
### Summary A missing end anchor (`$`) in the ClassDefinition UID validation regex allows an authenticated user with the
【大模型服务平台 TokenHub】&【智能体开发平台 ADP】& 【云开发 CloudBase】 关于腾讯云 Kimi K2.5 模型下线及切换升级的通知
【大模型服务平台 TokenHub】&【智能体开发平台 ADP】& 【云开发 CloudBase】 关于腾讯云 Kimi K2.5 模型下线及切换升级的通知
【大模型服务平台 TokenHub】 关于腾讯云 Kling & Vidu & HY系列部分视觉模型下线及计费调整的通知
【大模型服务平台 TokenHub】 关于腾讯云 Kling & Vidu & HY系列部分视觉模型下线及计费调整的通知
【云数据库 SQL Server】关于服务等级协议更新的公告
【云数据库 SQL Server】关于服务等级协议更新的公告
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the...
CVE-2026-71193
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constr
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving...
CVE-2026-71194
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOT