#cwe-918

共收录 2015 条相关情报。

漏洞预警2026-08-31 发布INFO

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smar...

CVE-2026-62993

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prio

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_cal...

CVE-2026-61640

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC tok

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and s...

CVE-2026-61638

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notificat

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-08-31 发布INFO

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

CVE-2026-81889

[poc.zip](https://github.com/user-attachments/files/30352020/poc.zip) ## Summary elFinder 2.1.69 is vulnerable to a Ser

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-918 #severity:high

漏洞预警2026-08-31 发布INFO

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component ...

CVE-2026-82905

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow...

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-693 #cwe-918

漏洞预警2026-08-31 发布INFO

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved ext...

CVE-2026-53507

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918 #cwe-1188

安全公告2026-08-31 发布INFO

oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

CVE-2026-53507

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1188 #cwe-200 #cwe-918

安全公告2026-08-31 发布INFO

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-693 #cwe-73 #cwe-918

漏洞预警2026-08-31 发布INFO

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version...

CVE-2026-79749

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version...

CVE-2026-79747

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-08-31 发布INFO

MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)

CVE-2026-79747

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-08-31 发布INFO

MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation

CVE-2026-79749

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

漏洞预警2026-08-31 发布INFO

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/han...

CVE-2026-82802

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLamb

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the co...

CVE-2026-82801

A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage o

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is att...

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetc

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHtt...

CVE-2026-82667

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isVali

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-08-31 发布INFO

@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetc

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

漏洞预警2026-08-31 发布INFO

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/sr...

CVE-2026-82630

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnecti

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-31 发布INFO

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that c

历史摘要 · 未重新核验 · NVD

#cve #cwe-918