senaite.core Vulnerable to Eval Injection and Missing Authorization
CVE-2026-54569
### Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable
#cwe-95
共收录 104 条相关情报。
← 返回所有主题chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in...
CVE-2026-78136
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/ken
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.
CVE-2026-78136
CVE-2026-78136 是 chirpmyradio 项目中的 CHIRP 软件（一个无线电编程工具）在 commit 39178db 之前版本中存在的一个 eval 注入漏洞。漏洞根源在于 drivers/kenwood_itm.p
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eva...
CVE-2026-61539
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
CVE-2026-61539
### Summary Xinference used Python's unsafe `eval()` function when parsing Llama3 tool-call output generated by a large
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To ...
CVE-2026-77810
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties i
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose constr...
CVE-2026-76833
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary J
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted in...
CVE-2026-71867
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property n...
CVE-2026-71866
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted in...
CVE-2026-71865
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted i...
CVE-2026-71864
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to...
CVE-2026-74234
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaSc
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template...
CVE-2026-34399
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench co
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Templa...
CVE-2026-34398
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/Bi
A remote code execution vulnerability exists in Tenable Security Center's report generation...
CVE-2026-19626
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authentica
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by ...
CVE-2026-19626
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authentica
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language at...
CVE-2026-13048
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitra
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale ...
CVE-2026-73602
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated use
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to exec...
CVE-2026-73601
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTO
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program...
CVE-2026-73248
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a