Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession...
CVE-2026-103764
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allow
#severity:critical
共收录 1449 条相关情报。
← 返回所有主题A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered...
CVE-2026-86345
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection w
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows :...
CVE-2026-71449
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by...
CVE-2026-18397
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are...
CVE-2009-20011
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote comman
Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php...
CVE-2009-20010
Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail su
Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability...
CVE-2009-20009
Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service aut
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 ...
CVE-2026-55395
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLoo
Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 ...
CVE-2026-55393
Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLo
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...
CVE-2026-104286
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through...
CVE-2026-14984
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote u
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG...
CVE-2026-102628
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in
Joyland AI app allows an attacker with shared network access to inject JavaScript into content...
CVE-2026-102667
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Withou
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
CVE-2026-92948
## Summary On Node.js 24 and newer, `vm2` can expose the host `node:test` module to sandboxed `NodeVM` code when the em
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
CVE-2026-92940
Summary vm2 3.11.6 exposes the host process's real `https.globalAgent` when a `NodeVM` is explicitly allowed to require
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
CVE-2026-92951
### Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
CVE-2026-92957
## Summary NodeVM normalizes `node:`-prefixed builtin specifiers during `require()` resolution, but it does not normali
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
CVE-2026-92935
## Summary The `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' && requireOp
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
CVE-2026-92937
## Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js pr
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
CVE-2026-92938
### Summary vm2 3.11.6 exposes Node.js's host `node:sqlite` module to `NodeVM` code when that builtin is allowed explic