In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes...
CVE-2026-105080
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve
#cwe-829
共收录 170 条相关情报。
← 返回所有主题In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in ...
CVE-2026-105080
ConvertX 是一款自托管的文件转换工具，其 0.19.0 之前的版本在 converters/calibre.ts 组件中未对 recipe 文件进行拦截，而是直接将其传递给 Calibre 的 ebook-convert 程序处理。
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/valida...
CVE-2026-55251
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to
NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files
CVE-2026-55251
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
CVE-2026-92950
### Summary The `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's "CLI" section r
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
CVE-2026-92951
### Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrar...
CVE-2026-86131
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attack
A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extr...
CVE-2026-87114
A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untr
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, ...
CVE-2026-54160
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.
CVE-2026-96443
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to...
CVE-2026-17647
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted c...
CVE-2026-17647
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an...
CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symb
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. ...
CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symb
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree...
CVE-2026-93993
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply ...
CVE-2026-93993
Mistral Vibe 是一款面向开发者的编码/仓库操作工具。在 2.25.5 之前的版本中，其 worktree（工作树）创建流程存在逻辑顺序缺陷：程序在执行「仓库信任验证」（trust validation）之前，就已经运行了 Git
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the devi...
CVE-2026-81305
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity o
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_URL in te...
CVE-2026-54918
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the a
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=import...
CVE-2026-54916
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The abse
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controll...
CVE-2026-54752
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The vali