3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file...

CVE-2026-55477

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse th

历史摘要 · 未重新核验 · NVD

Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` payloads from terminal ...

CVE-2026-48720

Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp a

历史摘要 · 未重新核验 · NVD

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains a potential arbit...

CVE-2026-48520

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playgroun

历史摘要 · 未重新核验 · NVD

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC ...

CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NP

历史摘要 · 未重新核验 · NVD

Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

### Summary `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` fie

历史摘要 · 未重新核验 · GitHub Advisory

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTem...

CVE-2026-49358

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGene

历史摘要 · 未重新核验 · NVD

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

CVE-2026-53915

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

历史摘要 · 未重新核验 · NVD

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is ...

CVE-2026-8118

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary

历史摘要 · 未重新核验 · NVD

Armeria: External Control of File Name or Path in xDS SDS DataSource

CVE-2026-11752

## External Control of File Name or Path in xDS SDS DataSource ### Summary `DataSourceStream` in the `:xds` module res

历史摘要 · 未重新核验 · GitHub Advisory

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated ...

CVE-2025-52465

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.2

历史摘要 · 未重新核验 · NVD

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was...

CVE-2026-10303

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated ag

历史摘要 · 未重新核验 · GitHub Advisory

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handli...

CVE-2026-10303

CVE-2026-10303 影响 ServerCo 的 getssl 工具（版本 2.49 及更早）。该工具用于自动获取和管理 ACME 证书。漏洞源于 getssl 在处理 ACME 挑战响应时，未严格按照 RFC 8555 对挑战令牌

历史摘要 · 未重新核验 · NVD

An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

CVE-2026-39006

An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component

历史摘要 · 未重新核验 · NVD

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used...

CVE-2026-34030

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code wh

历史摘要 · 未重新核验 · NVD

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.

CVE-2026-47643

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network

历史摘要 · 未重新核验 · NVD

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to...

CVE-2025-12656

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory de

历史摘要 · 未重新核验 · GitHub Advisory

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the de...

CVE-2025-12656

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory de

历史摘要 · 未重新核验 · NVD

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline...

CVE-2026-46397

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local Fil

历史摘要 · 未重新核验 · NVD

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An att...

CVE-2026-46399

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0

历史摘要 · 未重新核验 · NVD

Docling Core: Insufficient validation of image reference URIs

CVE-2026-44019

### Impact In versions `>= 2.5.0, = 2.74.1` ### Workarounds If upgrading is not immediately possible: - reject `file:`

历史摘要 · 未重新核验 · GitHub Advisory