In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1...
CVE-2026-77124
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did
#cwe-184
共收录 172 条相关情报。
← 返回所有主题In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administrati...
CVE-2026-77124
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in ...
CVE-2026-84370
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitig...
CVE-2026-84218
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service
RestrictedPython guard hooks can be shadowed via positional-only arguments
CVE-2026-55830
### Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that gua...
CVE-2026-52776
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versio
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
CVE-2026-52776
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versio
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful exploit ...
CVE-2026-65083
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an in
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands...
CVE-2026-76072
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattende
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in e...
CVE-2026-76072
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattende
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_sh...
CVE-2026-62676
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shar
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's e...
CVE-2026-18356
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist ca
The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues...
CVE-2026-72860
The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP reque
The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl ...
CVE-2026-72860
CVE-2026-72860 是 9router 中的一个服务端请求伪造（SSRF）漏洞，位于 POST /api/provider-nodes/validate 路由。该路由接受用户提供的 baseUrl 并发起服务端 HTTP 请求，本
DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in...
CVE-2026-68921
DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate optio
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
CVE-2026-68921
DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate optio
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be ...
CVE-2026-49825
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.def
lxml: javascript: URL bypass in Cleaner via xlink:href
CVE-2026-49825
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.def
Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix,...
CVE-2026-45741
Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenbe
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeS...
CVE-2026-73650
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version