#CVE

共收录 63861 条相关情报。

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access...

CVE-2026-116814

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email tem

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-27 发布INFO

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQ...

CVE-2026-116813

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-re

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped p...

CVE-2026-116812

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows pr

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布HIGH

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function cons...

CVE-2026-116811

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.get...

CVE-2026-116810

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-27 发布INFO

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking ...

CVE-2026-116809

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-27 发布HIGH

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.val...

CVE-2026-116808

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN s...

CVE-2026-116807

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and m...

CVE-2026-116806

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allow

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-27 发布INFO

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the cli...

CVE-2026-116805

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-27 发布MEDIUM

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_...

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expression

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. ...

CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xht...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attribute

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead o...

CVE-2026-116801

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo

历史摘要 · 未重新核验 · NVD

#cve #cwe-943

漏洞预警2026-10-27 发布MEDIUM

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Acc...

CVE-2026-116800

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-27 发布INFO

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulatio...

CVE-2026-116604

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown fun

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-10-27 发布MEDIUM

A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument...

CVE-2026-116603

A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file adm

来源摘录 · NVD

#cve #cwe-284 #cwe-434

漏洞预警2026-10-27 发布HIGH

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an alrea...

CVE-2026-111422

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` para

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-26 发布MEDIUM

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network ...

CVE-2026-76654

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a sym

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-26 发布MEDIUM

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create ...

CVE-2026-2270

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions

来源摘录 · NVD

#cve #cwe-639