The affected products are vulnerable to command injection attack that could allow an...
CVE-2026-93289
The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute
#severity:critical
共收录 1449 条相关情报。
← 返回所有主题An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web...
CVE-2026-13249
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Hone
ServiceNow has remediated a missing authorization vulnerability that was identified in the...
CVE-2026-86860
ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This
ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI...
CVE-2026-13016
ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerab
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
CVE-2026-61742
### Summary DBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport
http4s-scala-xml has an XML External Entity (XXE) processing issue
CVE-2026-61741
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. These decoders use
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
CVE-2026-61604
Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
CVE-2026-61732
## Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM m
A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function...
CVE-2026-96891
A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt:...
CVE-2026-97055
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOK
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege...
CVE-2026-18467
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19...
CVE-2026-93577
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 1
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19...
CVE-2026-89078
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 1
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the ...
CVE-2026-93352
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absen
IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially...
CVE-2026-6721
IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is inc
IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds...
CVE-2026-6730
IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user cou
IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This...
CVE-2026-6928
IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can i
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with...
CVE-2026-87898
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute...
CVE-2026-87899
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root pr
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated...
CVE-2026-87900
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary