Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

CVE-2026-55220

## Summary `Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource()` deserializes the `*__hot

历史摘要 · 未重新核验 · GitHub Advisory

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event...

CVE-2026-77991

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The admin

历史摘要 · 未重新核验 · GitHub Advisory

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers...

CVE-2026-59270

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative creden

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark...

CVE-2026-80585

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout...

CVE-2026-80589

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a neve

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some...

CVE-2026-80587

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions So

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS...

CVE-2026-80586

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpec

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in...

CVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via miss

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid...

CVE-2026-80558

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from prima

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first...

CVE-2026-80551

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe...

CVE-2026-80561

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_lock

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the...

CVE-2026-80554

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program

历史摘要 · 未重新核验 · GitHub Advisory

senaite.core Vulnerable to Eval Injection and Missing Authorization

CVE-2026-54569

### Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable

历史摘要 · 未重新核验 · GitHub Advisory

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

## Summary The PyPI account that publishes `pantheon-agents` was compromised in the June 2026 "Hades" PyPI supply-chain

历史摘要 · 未重新核验 · GitHub Advisory

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

CVE-2026-54523

## Summary In Kyverno v1.18.1, a tenant who can create a `NamespacedMutatingPolicy` in their own namespace can instruct

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected...

CVE-2026-79911

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the functio

历史摘要 · 未重新核验 · GitHub Advisory

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter...

CVE-2026-80138

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to s

历史摘要 · 未重新核验 · GitHub Advisory

DB-GPT builds the destination path for an uploaded skill from the multipart filename without...

CVE-2026-80104

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the uplo

历史摘要 · 未重新核验 · GitHub Advisory

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

CVE-2026-45018

### Am I affected? Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has bee

历史摘要 · 未重新核验 · GitHub Advisory

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

CVE-2026-49757

### Summary AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address rather than b

历史摘要 · 未重新核验 · GitHub Advisory