#cwe-94

共收录 1468 条相关情报。

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted i...

CVE-2026-71864

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-95 #cwe-116

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted int...

CVE-2026-62682

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-1336

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted in...

CVE-2026-62681

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-1336

漏洞预警2026-08-19 发布INFO

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Mana...

CVE-2026-18874

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Anothe

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-19 发布INFO

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a spec...

CVE-2026-72530

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-19 发布INFO

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider a...

CVE-2026-64850

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprin

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-19 发布INFO

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterf...

CVE-2026-53451

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73 #cwe-94

漏洞预警2026-08-19 发布INFO

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/a...

CVE-2026-45272

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlie

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-829

漏洞预警2026-08-19 发布INFO

ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the doc...

CVE-2026-76224

ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Grem

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-19 发布HIGH

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations...

CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can brea

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-08-19 发布INFO

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) The form...

CVE-2026-67364

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-19 发布INFO

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated ...

CVE-2026-18937

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input o

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

安全公告2026-08-18 发布INFO

jmespath.php has CompilerRuntime code injection via unescaped function names

CVE-2026-54133

## Impact `mtdowling/jmespath.php` can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-20 #cwe-94 #cwe-116 #severity:critical

安全公告2026-08-18 发布INFO

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

CVE-2026-55107

### Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rubygems #cwe-94 #cwe-470 #severity:critical

漏洞预警2026-08-18 发布INFO

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell comman...

CVE-2026-75911

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config f

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-18 发布INFO

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requiremen...

CVE-2026-75858

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-18 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insuffic...

CVE-2026-73073

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim co

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-829

漏洞预警2026-08-18 发布INFO

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the c...

CVE-2026-45117

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape use

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-18 发布INFO

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

CVE-2026-73343

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-18 发布INFO

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to so...

CVE-2026-50187

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plug

历史摘要 · 未重新核验 · NVD

#cve #cwe-94