#cwe-94

共收录 1464 条相关情报。

← 返回所有主题
漏洞预警2026-09-08 发布INFO

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and...

CVE-2026-86730

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated co

历史摘要 · 未重新核验 · NVD

安全公告2026-09-08 发布INFO

Craft CMS before 5.10.12 Remote Code Execution via element-index

CVE-2026-86732

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allow

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-08 发布INFO

Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

CVE-2026-86730

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated co

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-08 发布INFO

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page...

CVE-2026-86644

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_s

历史摘要 · 未重新核验 · NVD

安全公告2026-09-08 发布INFO

star7th showdoc API Page Save Endpoint editormd.js cross site scripting

CVE-2026-86644

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_s

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-08 发布INFO

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1...

CVE-2026-18021

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shor

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-08 发布INFO

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC ...

CVE-2026-34223

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-07 发布INFO

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode executi...

CVE-2026-12757

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin f

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-07 发布INFO

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component P...

CVE-2026-86301

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-07 发布INFO

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the com...

CVE-2026-86294

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unkno

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-07 发布INFO

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file manage_subject...

CVE-2026-86278

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected

历史摘要 · 未重新核验 · NVD

安全公告2026-09-05 发布INFO

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to...

CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-05 发布INFO

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/...

CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-05 发布INFO

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 vi...

CVE-2026-83627

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code

历史摘要 · 未重新核验 · NVD

安全公告2026-09-04 发布INFO

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

CVE-2026-75911

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-04 发布INFO

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CVE-2026-75858

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-04 发布INFO

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality ren...

CVE-2026-31020

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

CVE-2026-19298

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an au

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-04 发布INFO

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web pa...

CVE-2026-85694

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that eval

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-04 发布INFO

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (execute...

CVE-2026-85674

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is la

历史摘要 · 未重新核验 · NVD