CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

CVE-2026-76148

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

历史摘要 · 未重新核验 · NVD

CVE-2026-76148

CVE-2026-76148

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

历史摘要 · 未重新核验 · OSV.dev

Kimai before 2.53.0 API Token Leakage via Invoice Template

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call

历史摘要 · 未重新核验 · OSV.dev

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle i...

CVE-2026-54757

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions

历史摘要 · 未重新核验 · NVD

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

CVE-2026-54757

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions

历史摘要 · 未重新核验 · OSV.dev

Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...

CVE-2026-79249

Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive inform

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php. Such ma...

CVE-2026-79793

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown

历史摘要 · 未重新核验 · NVD

Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted file. (Chromium security severity: Me...

CVE-2026-79249

Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive inform

历史摘要 · 未重新核验 · NVD

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might ...

CVE-2026-65082

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code inj

历史摘要 · 未重新核验 · NVD

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment

### Summary `mcpgateway.services.prompt_service.PromptService` renders user-supplied prompt templates using Jinja2's pl

历史摘要 · 未重新核验 · GitHub Advisory

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior t...

CVE-2026-55585

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, sche

历史摘要 · 未重新核验 · NVD

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

CVE-2026-55585

### Summary The `qwed` package (version 5.1.1) passes attacker-controlled input directly to SymPy's `parse_expr()` func

历史摘要 · 未重新核验 · GitHub Advisory

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression a...

CVE-2026-55546

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engin

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.

CVE-2026-57909

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to e

历史摘要 · 未重新核验 · NVD

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs t...

CVE-2026-49845

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation lead...

CVE-2026-78654

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of th

历史摘要 · 未重新核验 · NVD

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attacker...

CVE-2026-56703

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not bl

历史摘要 · 未重新核验 · NVD

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c

CVE-2026-52490

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the proces

历史摘要 · 未重新核验 · NVD

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote...

CVE-2026-40877

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in th

历史摘要 · 未重新核验 · NVD

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This ...

CVE-2026-39975

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly

历史摘要 · 未重新核验 · NVD