langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
CVE-2026-85022
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace
#cwe-94
共收录 1466 条相关情报。
← 返回所有主题langgenius dify Splash Layout splash.tsx router.replace cross site scripting
CVE-2026-85021
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(s
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
CVE-2026-62674
### Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by upload
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
CVE-2026-62675
### Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. Th
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using...
CVE-2026-66786
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from th
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their...
CVE-2026-84645
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in indepen
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validat...
CVE-2026-66786
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from th
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, ...
CVE-2026-49832
DSpace open source software is a repository application which provides durable access to digital resources. From version
DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
CVE-2026-49832
DSpace open source software is a repository application which provides durable access to digital resources. From version
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds ...
CVE-2026-52833
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runt
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
CVE-2026-52833
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runt
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as th...
CVE-2026-84645
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in indepen
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such...
CVE-2026-77009
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workfl...
CVE-2026-84438
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/control
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomple...
CVE-2026-84437
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/c
An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain precondition...
CVE-2026-73701
An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabri
An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Pyt...
CVE-2026-51974
An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 throu
Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code wit...
CVE-2026-58572
Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially
Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection. This issue ...
CVE-2026-18808
Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klem
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing ...
CVE-2026-4813
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administ