#cwe-184

共收录 172 条相关情报。

漏洞预警2026-09-23 发布INFO

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (a...

CVE-2026-84706

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-09-23 发布INFO

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initCon...

CVE-2026-75884

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts au

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-09-22 发布INFO

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that...

CVE-2026-67615

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-184 #severity:high

漏洞预警2026-09-22 发布HIGH

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Ja...

CVE-2026-67615

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated

来源摘录 · NVD

#cve #cwe-184 #cwe-502

漏洞预警2026-09-21 发布INFO

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementat...

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-09-21 发布INFO

Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184

漏洞预警2026-09-18 发布INFO

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLooku...

CVE-2026-93598

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot s

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-09-18 发布INFO

ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

CVE-2026-93598

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot s

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184

安全公告2026-09-16 发布INFO

@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

CVE-2026-63671

## Summary `@nuxtjs/mdc` renders untrusted markdown (including raw HTML) to a Vue component tree. Across two prior advi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-184 #severity:high

安全公告2026-09-16 发布INFO

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

CVE-2026-61453

## Summary The XSS blueprint validator (`Security::detectXss()`) runs on the **raw page content before Twig processing*

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-79 #cwe-184 #cwe-1336 #severity:medium

漏洞预警2026-09-15 发布INFO

IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested p...

CVE-2026-11918

IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mech

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-09-15 发布INFO

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() i...

CVE-2026-57138

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mo

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-693

漏洞预警2026-09-11 发布INFO

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly ...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using A

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-09-09 发布INFO

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated a...

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-184

安全公告2026-09-08 发布INFO

SVGO: removeScripts allows executable links through namespace and control-character bypasses

CVE-2026-84370

## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-184 #severity:high

漏洞预警2026-09-08 发布INFO

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnera...

CVE-2026-33197

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs”

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-09-04 发布INFO

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs...

CVE-2026-85787

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before ve

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-184 #severity:high

漏洞预警2026-09-04 发布INFO

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modif...

CVE-2026-85787

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-09-02 发布INFO

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

CVE-2026-68921

## Summary `@dicebear/core` builds avatar SVGs from caller-supplied options. The numeric `rotate` option is interpolate

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-184 #severity:medium

安全公告2026-09-02 发布INFO

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

CVE-2026-62676

**Reporter:** Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) **Project:** `omnigent-ai/om

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-184 #severity:high