Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and userna...

CVE-2026-85724

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, Authorizations

历史摘要 · 未重新核验 · NVD

Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

CVE-2026-95842 · CVE-2026-95843 · CVE-2026-95844 · CVE-2026-95845 · CVE-2026-95846 · CVE-2026-95847 · CVE-2026-95848 · CVE-2026-85724

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, Authorizations

历史摘要 · 未重新核验 · OSV.dev

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

CVE-2026-87016

## Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match i

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend...

CVE-2026-87016

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user

历史摘要 · 未重新核验 · NVD

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

CVE-2026-87016

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user

历史摘要 · 未重新核验 · OSV.dev

Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values...

CVE-2026-68939

Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read ac

历史摘要 · 未重新核验 · NVD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or tr...

CVE-2026-73412

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on U

历史摘要 · 未重新核验 · NVD

Shescape: Path disclosure on Unix with Zsh

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Zsh, or `true` when the

历史摘要 · 未重新核验 · GitHub Advisory

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtit...

CVE-2026-49482

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an imprope

历史摘要 · 未重新核验 · NVD