#cwe-184

共收录 172 条相关情报。

漏洞预警2026-07-15 发布INFO

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql ...

CVE-2026-52888

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-200

安全公告2026-07-15 发布INFO

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

CVE-2026-52888

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184 #cwe-200

漏洞预警2026-07-14 发布INFO

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient an...

CVE-2026-48736

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53,

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-918

漏洞预警2026-07-14 发布INFO

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSu...

CVE-2026-45753

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-184

安全公告2026-07-14 发布INFO

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

CVE-2026-48736

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53,

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184 #cwe-918

漏洞预警2026-07-14 发布INFO

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitizati...

CVE-2026-45066

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-436

漏洞预警2026-07-14 发布MEDIUM

A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function ExecApprovalManager.CheckCommand of the file internal/tools/exec_approval.go....

CVE-2026-15625

该漏洞影响 GoClaw 3.11.3 版本，位于 internal/tools/exec_approval.go 文件中的 ExecApprovalManager.CheckCommand 函数。由于该函数对可执行命令的黑名单检查不完整，

历史摘要 · 未重新核验 · NVD

#cve #cwe-183 #cwe-184

安全公告2026-07-14 发布INFO

OpenClaw versions before 2026.6.1 contain a flaw in host exec environment filtering that could...

CVE-2026-62200

OpenClaw versions before 2026.6.1 contain a flaw in host exec environment filtering that could allow Git ext transport t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-184 #severity:high

安全公告2026-07-14 发布INFO

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss...

CVE-2026-62199

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup va

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-184 #severity:high

漏洞预警2026-07-13 发布HIGH

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and rea...

CVE-2026-62200

OpenClaw 2026.6.6 之前版本中存在一个主机执行环境过滤缺陷，允许攻击者滥用 Git 扩展传输。当受影响的特性被启用且可访问时，低信任度的调用者或配置的输入路径可能会执行或持久化超出其授权范围的操作。该漏洞无需用户交互即可通过

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-07-13 发布HIGH

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachab...

CVE-2026-62199

CVE-2026-62199 是 OpenClaw 软件中的一个高危漏洞，影响 2026.6.6 之前的所有版本。该漏洞存在于主机执行环境过滤机制中，未能正确过滤解释器启动变量，导致低信任度的调用者或配置的输入路径可以通过提供精心构造的环境

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-07-13 发布INFO

OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport

CVE-2026-62200

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184

安全公告2026-07-13 发布INFO

OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering

CVE-2026-62199

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup va

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184

安全公告2026-07-10 发布INFO

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

CVE-2026-54070

## Summary `renderPackageREADME` in `kernel/bazaar/readme.go` renders a Bazaar package README from Markdown to HTML wit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-79 #cwe-184 #severity:high

漏洞预警2026-07-08 发布INFO

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_...

CVE-2026-55830

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-07-08 发布INFO

RestrictedPython guard hooks can be shadowed via positional-only arguments

CVE-2026-55830

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184

安全公告2026-07-08 发布INFO

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

CVE-2026-49825

# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`) **Reporter:

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-184 #severity:high

漏洞预警2026-07-08 发布INFO

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, a...

CVE-2026-59929

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/rende

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-184

漏洞预警2026-07-08 发布INFO

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to confi...

CVE-2026-59261

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provide

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-522

安全公告2026-07-08 发布INFO

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

CVE-2026-59929

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/rende

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-184 #cwe-79