Improper neutralization of input during web page generation ('cross-site scripting')...
CVE-2026-34495
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls F
#advisory
共收录 23634 条相关情报。
← 返回所有主题A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven...
CVE-2026-18141
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthentic
The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON /...
CVE-2026-17346
The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatin
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI...
CVE-2026-17351
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_qu
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0,...
CVE-2026-17349
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a...
CVE-2026-17566
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query in
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the...
CVE-2026-56567
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of intern
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator...
CVE-2026-17348
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's bef
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to...
CVE-2025-62347
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is...
CVE-2026-16503
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an...
CVE-2026-17347
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a...
CVE-2026-16504
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database passw
The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin...
CVE-2026-17350
The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
CVE-2026-57232
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end mod
Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
CVE-2026-25552
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rat
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
CVE-2026-54737
### Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library re
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
CVE-2026-54737
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
CVE-2026-54725
vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
CVE-2026-54725
## Summary The vault-secrets-webhook reads the `vault.security.banzaicloud.io/vault-addr` annotation from any ConfigMap
hashi-vault-js has a path traversal and query parameter injection
CVE-2026-55100
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenat