Silverstripe: XSS in breadcrumbs in page list view
CVE-2026-54717
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable
#advisory
共收录 23530 条相关情报。
← 返回所有主题pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
CVE-2026-67422
pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0,
Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
CVE-2026-63637
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.
Decidim: Verification documents can be downloaded through reusable links
CVE-2026-45378
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
CVE-2026-18654
### Summary The AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. An
Decidim: HTML content blocks allow stored script execution
CVE-2026-45572
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3
Nx: Zip-Slip in the self-hosted remote cache
CVE-2026-71476
## Summary The Nx **self-hosted HTTP remote cache** extracts downloaded cache artifacts without constraining where file
Mermaid radar diagrams are vulnerable to DoS
CVE-2026-71439
### Impact Mermaid radar diagrams allow arbitrary large values for `ticks`, which can cause high CPU usage, freezing th
WGDashboard Server-Side Template Injection vulnerability
CVE-2026-15734
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated att
WGDashboard Remote Code Execution vulnerability
CVE-2026-15733
A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injectio
WGDashboard Server-Side Request Forgery Vulnerability
CVE-2026-15732
A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functiona
Mermaid configuration APIs allow prototype pollution
CVE-2026-71438
### Summary Mermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteCo
Mermaid allows CSS injection applying to sibling elements of the diagram
CVE-2026-50159
### Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with `#mer
Mermaid Architecture diagrams are vulnerable to prototype pollution
CVE-2026-71437
Rendering an untrusted `architecture-beta` diagram lets the diagram author write an arbitrary property with the value `h
Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll
CVE-2026-70559
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation t
Decidim: CSV census record endpoints improper authorization
CVE-2026-45415
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3
Decidim: JWT-backed authentication can be replayed across organizations
CVE-2026-45414
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API auth
diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts
CVE-2026-70557
diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
CVE-2026-71433
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoin
GitHub CLI: Terminal escape sequence injection in multiple `gh` commands
CVE-2026-64654
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed ex