Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) in...

CVE-2026-72782

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secre

历史摘要 · 未重新核验 · NVD

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run ...

CVE-2026-72764

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (

来源摘录 · NVD

Craft CMS: Authenticated leak of secret environment variables

Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing

历史摘要 · 未重新核验 · GitHub Advisory

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment vari...

CVE-2026-67427

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable

历史摘要 · 未重新核验 · NVD

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed conta...

CVE-2026-54727

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink

历史摘要 · 未重新核验 · NVD

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

CVE-2026-54727

## Affected Component - **Package:** proot-distro - **Affected command:** `restore` - **Attack surface:** Host-side Ter

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_s...

CVE-2026-63914

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns

来源摘录 · NVD

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain r...

CVE-2026-54497

view_component 是一个用于在 Ruby on Rails 中构建可复用、可测试和封装视图组件的框架。从 4.0.0 到 4.12.0 版本，ViewComponent::Base 实例在多次调用 render_in 时保留了渲

历史摘要 · 未重新核验 · NVD

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

CVE-2026-54504

### Summary `@andrea9293/mcp-documentation-server` v1.13.0 documents that a Web UI starts automatically on port `3080`.

历史摘要 · 未重新核验 · GitHub Advisory

ViewComponent: Reused Component Instances Retain Stale Render Context

CVE-2026-54497

# Reused Component Instances Retain Stale Render Context ## Summary `ViewComponent::Base` instances retain multiple re

历史摘要 · 未重新核验 · GitHub Advisory

open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

CVE-2026-54495

## Summary A namespaced `FeatureFlagSource` or `InProcessConfiguration` resource can be referenced cross-namespace via

历史摘要 · 未重新核验 · GitHub Advisory

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` an...

CVE-2026-14960

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interf

历史摘要 · 未重新核验 · NVD

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\B...

CVE-2026-45077

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.4

历史摘要 · 未重新核验 · NVD

A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to acce...

CVE-2026-59835

A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 th

历史摘要 · 未重新核验 · NVD

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the V...

CVE-2026-53657

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima

历史摘要 · 未重新核验 · NVD

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived pat...

CVE-2026-53648

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product fi

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component P...

CVE-2026-14611

A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of

历史摘要 · 未重新核验 · NVD

Steeltoe's static JWKS cache shared across schemes and never invalidated

CVE-2026-50202

### Summary The JWT signing key cache in `TokenKeyResolver` uses `kid` as the sole cache key without namespacing by aut

历史摘要 · 未重新核验 · GitHub Advisory

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podm...

CVE-2026-57231

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environ

历史摘要 · 未重新核验 · NVD

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger...

CVE-2026-56077

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows

历史摘要 · 未重新核验 · GitHub Advisory