meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
CVE-2026-54549
## Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch ### Summary The `upload_
#advisory
共收录 23779 条相关情报。
← 返回所有主题sh _uid does not drop supplementary groups (incomplete privilege drop)
CVE-2026-54552
### Impact The `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems. When `sh` was run from
AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
CVE-2026-11400
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identif
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
CVE-2026-45309
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on to
plone.restapi: Stored XSS by spoofing mime type
### Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whene
plone.app.textfield: Stored XSS by spoofing mime type
CVE-2026-54503
### Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whene
RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
CVE-2026-50185
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-
JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-52746
JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis func
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user...
CVE-2026-9202
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1...
CVE-2026-9198
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER toke
Improper neutralization of special elements used in an SQL command ('SQL injection')...
CVE-2026-8297
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics En
An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox...
CVE-2026-9585
An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...
CVE-2026-9588
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicem
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions...
CVE-2025-59866
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Es
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution...
CVE-2026-9762
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under u
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...
CVE-2026-9586
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint pr
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the...
CVE-2026-63308
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template help
SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing...
CVE-2026-63309
SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...
CVE-2026-9587
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file
Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing...
CVE-2026-12694
Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Proper