#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-22 发布HIGH

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers...

CVE-2021-48017

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in t

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布CRITICAL

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthentic...

CVE-2021-48016

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is wri

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-22 发布HIGH

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers ca...

CVE-2021-48015

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to re

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownl...

CVE-2021-48013

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary file

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /con...

CVE-2020-37284

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. ...

CVE-2019-25779

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitra

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter....

CVE-2018-25439

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipu...

CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email param...

CVE-2017-20290

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenti

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布MEDIUM

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path paramete...

CVE-2017-20288

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfr...

CVE-2017-20287

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-...

CVE-2026-114348

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 bef

来源摘录 · NVD

#cve #cwe-1289 #cwe-209

漏洞预警2026-10-22 发布HIGH

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to ...

CVE-2026-112085

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 a

来源摘录 · NVD

#cve #cwe-1385 #cwe-346

漏洞预警2026-10-22 发布INFO

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erla...

CVE-2026-93471

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthentic

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-22 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the...

CVE-2026-86696

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated a

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-22 发布LOW

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending...

CVE-2026-21811

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets acc

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-22 发布INFO

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), w...

CVE-2026-110974

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSON

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-22 发布MEDIUM

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string dur...

CVE-2026-114460

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an

来源摘录 · NVD

#cve #cwe-193

漏洞预警2026-10-22 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and c...

CVE-2026-105270

Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthent

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-22 发布MEDIUM

NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords fr...

CVE-2026-114223

NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local a

来源摘录 · NVD

#cve #cwe-312