Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount opti...

CVE-2026-41013

Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF s

历史摘要 · 未重新核验 · NVD

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection...

CVE-2026-49373

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

历史摘要 · 未重新核验 · GitHub Advisory

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

CVE-2026-49373

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

历史摘要 · 未重新核验 · NVD

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent sk...

CVE-2026-48116

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

历史摘要 · 未重新核验 · NVD

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamus...

CVE-2026-44712

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such a

历史摘要 · 未重新核验 · NVD

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

CVE-2026-45068

### Description Symfony Mailer selects a transport via the `MAILER_DSN` environment variable / configuration (e.g. `smt

历史摘要 · 未重新核验 · GitHub Advisory

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

CVE-2026-44210

## Summary Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line

历史摘要 · 未重新核验 · GitHub Advisory

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards ...

CVE-2026-44450

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command

历史摘要 · 未重新核验 · NVD

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only va...

CVE-2026-44449

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the

历史摘要 · 未重新核验 · NVD

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote...

CVE-2026-47114

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbit

历史摘要 · 未重新核验 · GitHub Advisory

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query ...

CVE-2026-47114

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbit

历史摘要 · 未重新核验 · NVD

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

Diesel allows users to configure various options for PostgreSQL's `COPY FROM` and `COPY TO` statements. These configurat

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/o...

CVE-2026-8773

A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the fun

历史摘要 · 未重新核验 · NVD

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tg...

CVE-2026-46483

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimu

历史摘要 · 未重新核验 · NVD

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is proc...

CVE-2026-45158

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP

历史摘要 · 未重新核验 · NVD

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Re...

CVE-2026-44193

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_se

历史摘要 · 未重新核验 · NVD

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions...

CVE-2026-42266

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · NVD

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py). ...

CVE-2026-31230

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kub

历史摘要 · 未重新核验 · NVD

exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read ...

CVE-2026-43893

exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifToo

历史摘要 · 未重新核验 · NVD

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via...

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), whi

历史摘要 · 未重新核验 · GitHub Advisory