A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be u...

CVE-2026-65219

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP mess

历史摘要 · 未重新核验 · NVD

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

CVE-2026-114145

### Summary `create_submodule(name, path, url)` clones a submodule into the repo's own `.git` directory before it reje

历史摘要 · 未重新核验 · GitHub Advisory

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodul...

CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/

历史摘要 · 未重新核验 · NVD

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/

历史摘要 · 未重新核验 · OSV.dev

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the config...

CVE-2026-109162

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the def

历史摘要 · 未重新核验 · NVD

Docling imports plugin entry points before the allow_external_plugins check

CVE-2026-105745

### Summary `allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own m

历史摘要 · 未重新核验 · GitHub Advisory

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to versio...

CVE-2026-26287

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

历史摘要 · 未重新核验 · NVD

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

CVE-2026-26287

## Summary A bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`Enforc

历史摘要 · 未重新核验 · GitHub Advisory

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factorie...

CVE-2026-105745

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through...

CVE-2026-103353

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Func

历史摘要 · 未重新核验 · NVD

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list,

历史摘要 · 未重新核验 · GitHub Advisory

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host rule...

CVE-2026-93330

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edi

历史摘要 · 未重新核验 · NVD

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its...

CVE-2026-93304

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has

历史摘要 · 未重新核验 · GitHub Advisory

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read ...

CVE-2026-93304

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has

历史摘要 · 未重新核验 · NVD

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

CVE-2026-93304

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has

历史摘要 · 未重新核验 · OSV.dev

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an...

CVE-2026-73446

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can

历史摘要 · 未重新核验 · GitHub Advisory

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that...

CVE-2026-73446

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can

历史摘要 · 未重新核验 · NVD

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

CVE-2026-59305

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stre

历史摘要 · 未重新核验 · NVD

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in ...

CVE-2026-68930

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for reci

历史摘要 · 未重新核验 · NVD

Russh: Channel-scoped server callbacks can be reached without an open channel

CVE-2026-68930

There is a server-side channel state issue in `russh`. After a client is authenticated, `russh` can dispatch channel-sc

历史摘要 · 未重新核验 · GitHub Advisory