Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
CVE-2026-76804
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loadi
#cwe-284
共收录 1965 条相关情报。
← 返回所有主题Nuclei: Local File Read via MySQL Client Sandbox Bypass
CVE-2026-76803
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component...
CVE-2026-95500
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.php. Executing a man...
CVE-2026-95499
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_u
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger...
CVE-2026-79316
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configur
A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC i...
CVE-2026-94050
A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component ...
CVE-2026-94036
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element i
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on...
CVE-2026-87840
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative boo
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not...
CVE-2026-87839
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of t
A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation causes information disc...
CVE-2026-93971
A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevo
aiyiyi121 SxDevOps settings.py information disclosure
CVE-2026-93971
A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevo
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed t...
CVE-2026-87840
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative boo
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to u...
CVE-2026-87839
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of t
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a req...
CVE-2026-92099
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied que
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.
CVE-2026-11549
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerab
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run ...
CVE-2026-58197
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to Too
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
CVE-2026-58197
## Summary A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
CVE-2026-58197
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to Too
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to interc...
CVE-2026-93676
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictio
vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: [...
CVE-2026-93604
vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allow