o6 Automation open62541 Use After Free
CVE-2026-63035
A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attack
#advisory
共收录 23636 条相关情报。
← 返回所有主题MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments
CVE-2026-66420
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated
o6 Automation open62541 Integer Overflow or Wraparound
CVE-2026-63559
An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to r
NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference
CVE-2026-18064
An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a s
RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath
CVE-2026-64816
RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_proce
Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers
CVE-2026-62845
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore driv
Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation
CVE-2026-62246
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane dat
AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler
CVE-2026-61526
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through
OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field
CVE-2026-66418
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attack
LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard
CVE-2026-68503
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships def
LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE
CVE-2026-68502
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.
GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS
CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b
GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
CVE-2026-55768
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b
Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
CVE-2026-68501
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
GoAccess: Heap Out-of-Bounds Write in parse_browser()
CVE-2026-54715
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b
Sylius Mollie Plugin: Payment status forgery via the payment webhook
CVE-2026-68500
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
CVE-2026-68499
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
CVE-2026-67550
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex again
Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
CVE-2026-65835
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
CVE-2026-65834
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMet