#cwe-94

共收录 1468 条相关情报。

← 返回所有主题

漏洞预警2026-08-27 发布INFO

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes a...

CVE-2026-53578

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-08-27 发布INFO

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and t...

CVE-2026-48996

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-08-27 发布INFO

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation ...

CVE-2026-47727

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe impor

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1336

漏洞预警2026-08-27 发布INFO

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain c...

CVE-2026-18885

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

安全公告2026-08-27 发布INFO

Trilium: Note Import to RCE via Book Note

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79 #cwe-94

安全公告2026-08-27 发布INFO

Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml

CVE-2026-53578

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79 #cwe-94

安全公告2026-08-27 发布INFO

Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

CVE-2026-48996

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79 #cwe-94

漏洞预警2026-08-27 发布INFO

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-bu...

CVE-2026-81719

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature pol

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-27 发布INFO

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, i...

CVE-2026-81096

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

安全公告2026-08-27 发布INFO

silverstripe/userforms vulnerable to remote code execution via userforms email subject

CVE-2026-54721

### Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run ar

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-20 #cwe-94 #severity:high

安全公告2026-08-27 发布INFO

Silverstripe UserForms: Remote code execution via userforms email subject

CVE-2026-54721

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-94

安全公告2026-08-27 发布INFO

Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)

CVE-2026-47727

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe impor

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1336 #cwe-94

安全公告2026-08-27 发布INFO

openssl_encrypt before 1.4.9 Remote Code Execution via Plugin

CVE-2026-81719

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature pol

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-94

安全公告2026-08-27 发布INFO

ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape

CVE-2026-81096

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authenticat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-94

漏洞预警2026-08-27 发布INFO

Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directo...

CVE-2026-81743

Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without res

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-94

漏洞预警2026-08-27 发布INFO

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals...

CVE-2026-81662

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. Whil

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-94

漏洞预警2026-08-27 发布INFO

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multis...

CVE-2026-19225

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators,

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-27 发布INFO

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network ...

CVE-2026-19223

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-26 发布INFO

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to e...

CVE-2026-74851

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked func

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-26 发布INFO

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers w...

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call

历史摘要 · 未重新核验 · NVD

#cve #cwe-94