vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cm...

CVE-2026-119567

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute deni

来源摘录 · NVD

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

CVE-2026-61438

### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML

来源摘录 · GitHub Advisory

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-96196

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a secu

来源摘录 · NVD

Hydra legacy target blacklist permits unsafe PyYAML loading

## Summary Hydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-co

历史摘要 · 未重新核验 · GitHub Advisory

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

CVE-2026-117530

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted command

历史摘要 · 未重新核验 · NVD

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in...

CVE-2026-115845

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allo

历史摘要 · 未重新核验 · GitHub Advisory

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using tra...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows att

来源摘录 · NVD

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Auth...

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() c

来源摘录 · NVD

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml in

历史摘要 · 未重新核验 · GitHub Advisory

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling o

历史摘要 · 未重新核验 · GitHub Advisory

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url(...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling o

来源摘录 · NVD

CVE-2026-114728

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling o

历史摘要 · 未重新核验 · OSV.dev

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using ...

CVE-2026-113605

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allo

历史摘要 · 未重新核验 · NVD

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class reso...

CVE-2026-112777

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its

历史摘要 · 未重新核验 · NVD

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive to...

CVE-2026-84316

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits config

历史摘要 · 未重新核验 · NVD

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename...

CVE-2026-108976

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has

历史摘要 · 未重新核验 · GitHub Advisory

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issu...

CVE-2026-108976

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has

历史摘要 · 未重新核验 · NVD

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

CVE-2026-105648

### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user

历史摘要 · 未重新核验 · GitHub Advisory

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before a...

CVE-2026-106445

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars looku

历史摘要 · 未重新核验 · NVD

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 inco...

CVE-2026-106442

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instanti

历史摘要 · 未重新核验 · NVD