An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management...
CVE-2026-51953
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication
#advisory
共收录 23634 条相关情报。
← 返回所有主题An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows...
CVE-2026-52134
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass au
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
CVE-2026-54910
### Summary The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters:
guard-livereload has a directory traversal vulnerability
CVE-2016-1000305
The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation i
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
CVE-2026-54785
### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without c
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
CVE-2026-54768
## Summary The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The r
core-geonetwork has an Open Redirect Bypass
CVE-2026-53573
### Summary GeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled extern
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
CVE-2026-54908
### Impact Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. ### Patches
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
CVE-2026-54909
### Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute ### Patches Upgrad
sigstore-go fails to check signature timestamps against a signing key's validity period
CVE-2026-54787
sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
CVE-2026-53608
### Summary The `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Go
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
CVE-2026-53607
### Summary When `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53609
## Summary `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated e
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
CVE-2026-53606
## Summary sanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `nau
sentence-transformers contains a security control bypass vulnerability that allows attackers to...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code e
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary...
CVE-2026-51785
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted req
PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery ...
CVE-2026-50986
PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment valid
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...
CVE-2026-38713
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...
CVE-2026-38708
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2
TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in...
CVE-2026-38710
TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock in