#cwe-74

共收录 1605 条相关情报。

← 返回所有主题
漏洞预警2026-08-03 发布INFO

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Pl...

CVE-2026-18601

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the fi

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-03 发布INFO

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network o...

CVE-2026-18600

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.s

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-03 发布INFO

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logre...

CVE-2026-18599

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the f

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-03 发布INFO

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the comp...

CVE-2026-18598

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_l

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-03 发布INFO

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php ...

CVE-2026-18592

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-31 发布INFO

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, ...

CVE-2026-55100

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenat

历史摘要 · 未重新核验 · NVD

安全公告2026-07-31 发布INFO

hashi-vault-js has a path traversal and query parameter injection

CVE-2026-55100

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenat

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-31 发布INFO

hashi-vault-js has a path traversal and query parameter injection

CVE-2026-55100

## Summary The `hashi-vault-js` library is vulnerable to path traversal and query string injection due to the lack of p

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-29 发布INFO

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/m...

CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-29 发布INFO

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value...

CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before

历史摘要 · 未重新核验 · NVD

安全公告2026-07-29 发布INFO

Logging operator has Fluentd configuration injection that allows remote code execution

CVE-2026-54680

### Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly int

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys thro...

CVE-2026-54666

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/sch

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components....

CVE-2026-54664

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/sch

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates s...

CVE-2026-54661

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templat

历史摘要 · 未重新核验 · NVD

安全公告2026-07-29 发布INFO

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

CVE-2026-54666

### Summary `swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{i

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-07-29 发布INFO

swagger-typescript-api vulnerable to code injection via unescaped enum string values

CVE-2026-54664

### Summary `swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generat

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-28 发布INFO

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.

CVE-2026-18085

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows A

历史摘要 · 未重新核验 · NVD

安全公告2026-07-24 发布INFO

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

CVE-2026-55404

### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may pro

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-07-24 发布INFO

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some...

CVE-2026-16765

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality o

历史摘要 · 未重新核验 · GitHub Advisory