#cwe-94

共收录 1468 条相关情报。

← 返回所有主题
漏洞预警2026-07-09 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken ...

CVE-2026-59856

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/p

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with sanitization enabled,...

CVE-2026-59833

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content t

历史摘要 · 未重新核验 · NVD

安全公告2026-07-09 发布INFO

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

CVE-2026-52778

### Summary An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-09 发布INFO

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 con...

CVE-2026-59826

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation...

CVE-2026-15202

A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzm

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a mani...

CVE-2026-15195

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Po

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events ...

CVE-2026-59216

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call de

历史摘要 · 未重新核验 · NVD

安全公告2026-07-09 发布INFO

apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

CVE-2026-15195

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Po

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

CVE-2026-59216

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call de

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-09 发布INFO

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question...

CVE-2026-15187

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Publ

历史摘要 · 未重新核验 · NVD

安全公告2026-07-09 发布INFO

enquirer Public Package API Enquirer.set prototype pollution

CVE-2026-15187

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Publ

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk

CVE-2026-52200

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operato...

CVE-2026-35211

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

CVE-2026-49832

## Overview Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for [COAR Notify/LDN messages

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-08 发布INFO

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths...

CVE-2026-59821

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

CVE-2026-59821

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the templa...

CVE-2026-53951

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Copier: trust-prefix bypass via path traversal runs tasks unprompted

CVE-2026-53951

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-07 发布INFO

Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler...

CVE-2026-55408

Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution throu

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-07 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whos...

CVE-2026-53751

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation l

历史摘要 · 未重新核验 · NVD