Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

CVE-2026-55703

### Impact Any activated account in a company can read every maintenance record for that company (asset tag, supplier, p

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

CVE-2026-55694

### Impact An attacker can completely bypass file-name randomization security and without authorization download confide

历史摘要 · 未重新核验 · GitHub Advisory

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

CVE-2026-53965

## Summary The HTTP client transport in `mcp/sdk` reads a Server-Sent-Events (SSE) response stream incrementally and ap

历史摘要 · 未重新核验 · GitHub Advisory

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

### Summary The Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and versio

历史摘要 · 未重新核验 · GitHub Advisory

LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

### Summary The `graph_descr.` family of settings is echoed verbatim without `htmlspecialchars()` in `includes/html/page

历史摘要 · 未重新核验 · GitHub Advisory

LibreNMS Vulnerable to Remote Code Execution via AboutController

# Remote Code Execution via AboutController in LibreNMS ## Summary A Remote Code Execution (RCE) vulnerability exists

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

CVE-2026-62988

## Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affe

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection

CVE-2026-55593

## Summary The Froxlor AJAX endpoint (`lib/ajax.php`) is missing Cross-Site Request Forgery (CSRF) protection. While th

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

CVE-2026-54543

Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into gene

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

CVE-2026-54348

### Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

CVE-2026-54347

### Summary A stored Cross-Site Scripting (XSS) vulnerability in Froxlor's DNS editor allows an authenticated user with

历史摘要 · 未重新核验 · GitHub Advisory

MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

CVE-2026-55224

## Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall ### Summary The app-store plugin service conca

历史摘要 · 未重新核验 · GitHub Advisory

jmespath.php has CompilerRuntime code injection via unescaped function names

CVE-2026-54133

## Impact `mtdowling/jmespath.php` can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

CVE-2026-53653

### Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimen

历史摘要 · 未重新核验 · GitHub Advisory

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

CVE-2026-55072

### Summary A missing end anchor (`$`) in the ClassDefinition UID validation regex allows an authenticated user with the

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

CVE-2026-47132

### Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logg

历史摘要 · 未重新核验 · GitHub Advisory

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

CVE-2026-45694

### Summary `LegacyController.php:75` writes the page title into a `document.title` JS assignment using string interpola

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Authenticated backend users can bypass Users controller permission checks

CVE-2026-35445

### Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechan

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

CVE-2026-32639

### Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJA

历史摘要 · 未重新核验 · GitHub Advisory

Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

CVE-2026-32593

## Impact The Backend Filter widget (`Backend\Widgets\Filter`) is vulnerable to SQL injection through the `numberrange`

历史摘要 · 未重新核验 · GitHub Advisory