FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

CVE-2026-47719

## Summary An unauthenticated attacker (Alice) connects to FUXA's Socket.IO endpoint and emits a `device-webapi-request

历史摘要 · 未重新核验 · GitHub Advisory

actual Allows Electron to Run As Node

CVE-2026-42890

## Summary A electron run as node vulnerability was identified in `actual` (macOS application, version `25.x (Electron

历史摘要 · 未重新核验 · GitHub Advisory

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

CVE-2026-47761

### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted `data-mce-*`

历史摘要 · 未重新核验 · GitHub Advisory

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

CVE-2026-47762

### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and injec

历史摘要 · 未重新核验 · GitHub Advisory

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

CVE-2026-47759

### Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style).

历史摘要 · 未重新核验 · GitHub Advisory

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

CVE-2026-47760

### Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer.

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: OAuth Tokens Persist Through Security Events

### Summary OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password,

历史摘要 · 未重新核验 · GitHub Advisory

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

CVE-2026-48017

### Summary The `POST /runners/load-reader` endpoint in DbGate accepts a `functionName` parameter that is directly inte

历史摘要 · 未重新核验 · GitHub Advisory

Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

CVE-2026-47684

Summary: The private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g.

历史摘要 · 未重新核验 · GitHub Advisory

Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

CVE-2026-47670

### Summary DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials c

历史摘要 · 未重新核验 · GitHub Advisory

DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

CVE-2026-47669

The `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted

历史摘要 · 未重新核验 · GitHub Advisory

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

CVE-2026-47668

### Summary DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Missing Ownership Check in MCP Attachment Read

CVE-2026-47388

### Summary A low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage,

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

CVE-2026-47387

### Summary The shared form-view submit handler in NocoDB writes the form's `redirect_url` to `window.location.href` af

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: OAuth Authorization Code Race Condition

CVE-2026-47386

### Summary Two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct va

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Path Traversal via SQLite Source Filename

CVE-2026-47385

### Summary An authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file o

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: SQL Injection via Column Title in Bulk GroupBy

CVE-2026-47384

### Summary An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Stored Cross-Site Scripting via Row Comments

CVE-2026-47383

### Summary An authenticated commenter could store HTML in row comments that executed as script when other users hovered

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Server-Side Request Forgery via Database Connection Host

CVE-2026-47382

### Summary The connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving an

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Cross-Workspace Integration Use in Connection Test

CVE-2026-47381

### Summary A user in one workspace could exercise another workspace's integration through the `testConnection` endpoint

历史摘要 · 未重新核验 · GitHub Advisory