#cwe-610

共收录 28 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders at...

CVE-2026-119342

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.1

来源摘录 · NVD

#cve #cwe-20 #cwe-22 #cwe-610 #cwe-918

漏洞预警2026-10-28 发布INFO

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resou...

CVE-2026-67077

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-610 #cwe-918

漏洞预警2026-09-29 发布INFO

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictio...

CVE-2026-95376

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leverag

历史摘要 · 未重新核验 · NVD

#cve #cwe-610

安全公告2026-09-28 发布INFO

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

CVE-2026-19032

### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.des

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-470 #cwe-610 #severity:medium

漏洞预警2026-09-28 发布INFO

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated ...

CVE-2026-81375

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 202

历史摘要 · 未重新核验 · NVD

#cve #cwe-610

漏洞预警2026-09-01 发布INFO

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deseriali...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-470 #cwe-610

安全公告2026-09-01 发布INFO

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI sch

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-470 #cwe-610

安全公告2026-08-25 发布INFO

Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65...

CVE-2026-79256

Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attack

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-610

漏洞预警2026-08-25 发布INFO

Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentiall...

CVE-2026-79256

Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-610

漏洞预警2026-08-25 发布INFO

Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security...

CVE-2026-78966

Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web

历史摘要 · 未重新核验 · NVD

#cve #cwe-610

漏洞预警2026-08-21 发布INFO

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), f...

CVE-2026-62960

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bun

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-610

漏洞预警2026-08-19 发布INFO

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The ...

CVE-2026-76572

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _trans

历史摘要 · 未重新核验 · NVD

#cve #cwe-610 #cwe-611

漏洞预警2026-07-30 发布MEDIUM

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a...

CVE-2026-68562

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp

来源摘录 · NVD

#cve #cwe-610

漏洞预警2026-07-28 发布INFO

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py f...

CVE-2026-55390

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema pars

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200 #cwe-610

漏洞预警2026-07-28 发布INFO

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV....

CVE-2026-55389

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200 #cwe-610

安全公告2026-07-28 发布INFO

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

CVE-2026-55389

### Summary `datamodel-code-generator` resolves JSON-Schema `$ref` targets that point at the local filesystem without r

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #cwe-200 #cwe-610 #severity:high

安全公告2026-07-28 发布INFO

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

CVE-2026-55390

### Summary When generating models from an XML Schema (`--input-file-type xmlschema`), `datamodel-code-generator` resol

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #cwe-200 #cwe-610 #severity:high

漏洞预警2026-07-15 发布INFO

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplyi...

CVE-2026-15583

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's enviro

历史摘要 · 未重新核验 · NVD

#cve #cwe-610

漏洞预警2026-07-09 发布INFO

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfil...

CVE-2026-12879

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-610

漏洞预警2026-06-24 发布INFO

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission ...

CVE-2026-57301

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned

历史摘要 · 未重新核验 · NVD

#cve #cwe-610