SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is proces...

CVE-2026-44758

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted

历史摘要 · 未重新核验 · NVD

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction funct...

CVE-2026-72904

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file

历史摘要 · 未重新核验 · NVD

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without s...

CVE-2026-72718

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system

历史摘要 · 未重新核验 · NVD

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint

历史摘要 · 未重新核验 · NVD

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-55799

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgra

历史摘要 · 未重新核验 · NVD

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which f...

CVE-2026-44416

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. U

历史摘要 · 未重新核验 · NVD

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-42537

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0

历史摘要 · 未重新核验 · NVD

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.7 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc p...

CVE-2026-66915

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.7 - An unauthenticated attacker could execute ar

历史摘要 · 未重新核验 · NVD

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argu...

CVE-2026-19378

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the

历史摘要 · 未重新核验 · NVD

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP A...

CVE-2026-46409

OpenYak 是一款本地优先的智能体运行时，专门用于可靠地调用工具的模型，并在此基础上提供桌面工作区。在 1.1.3 版本之前，OpenYak 的桌面后端存在一个严重安全缺陷：其 HTTP API 被绑定在 127.0.0.1 的随机端口

历史摘要 · 未重新核验 · NVD

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment I...

CVE-2026-19230

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /soci

历史摘要 · 未重新核验 · NVD

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could...

CVE-2026-17603

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the Data

历史摘要 · 未重新核验 · GitHub Advisory

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores...

CVE-2026-17603

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the Data

历史摘要 · 未重新核验 · NVD

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the ar...

CVE-2026-19209

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file

历史摘要 · 未重新核验 · NVD

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

## Summary `Repo.init()` forwards `**kwargs` verbatim to `git init` with no unsafe-option guard and no `allow_unsafe_opt

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. T...

CVE-2026-19207

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some

历史摘要 · 未重新核验 · NVD

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via s...

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8

历史摘要 · 未重新核验 · NVD

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat te...

CVE-2026-48054

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin

历史摘要 · 未重新核验 · NVD

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privi...

CVE-2026-45572

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

历史摘要 · 未重新核验 · NVD

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.ja...

CVE-2026-19110

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlR

历史摘要 · 未重新核验 · NVD