CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
CVE-2026-63221
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound v
#advisory
共收录 23636 条相关情报。
← 返回所有主题CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
CVE-2026-63220
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-For
Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored
CVE-2026-62323
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the se
Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials
CVE-2026-55502
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin r
Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients
CVE-2026-55499
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscri
Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)
CVE-2026-55497
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image
Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate
CVE-2026-55496
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActi
Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
CVE-2026-55495
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-W
Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection
CVE-2026-18157
A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit
Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
CVE-2026-14541
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mc
Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
CVE-2026-14540
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-t
Denial of Service via Unrestricted Payload Buffering in MCP Toolbox
CVE-2026-14539
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up
BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
CVE-2026-14538
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Googl
Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
CVE-2026-14537
Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0
MZ Automation lib60870 Out-of-bounds Read
CVE-2026-61893
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBu
MZ Automation lib60870 Out-of-bounds Read
CVE-2026-63033
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationO
SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation
CVE-2026-10031
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-direc
OpenClaw Dashboard Stored XSS via lastMessage Session Field
CVE-2026-66421
OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to
o6 Automation open62541 Integer Underflow
CVE-2026-63362
An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cau
o6 Automation open62541 Integer Overflow or Wraparound
CVE-2026-65423
An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to t