A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. ...
CVE-2026-11720
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstr
#severity:critical
共收录 1468 条相关情报。
← 返回所有主题Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container...
CVE-2026-58053
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docke
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing...
CVE-2026-12415
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on th
Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated...
CVE-2026-28701
Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape
The DMP-5000 devices are shipped with a default administrative web account with weak...
CVE-2026-31928
The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
CVE-2026-53519
### Summary `fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
### Summary In nezha **v1.14.13–v1.14.14** and **v2.0.0–v2.0.9**, the WebSocket endpoints `GET /ws/terminal/:id` and `G
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the...
CVE-2026-9222
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authe
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate...
CVE-2026-40702
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access...
CVE-2025-71334
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missin
Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote...
CVE-2025-71336
Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnera
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process...
CVE-2025-71338
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauth
Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account...
CVE-2025-71327
Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api...
CVE-2025-71333
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoin
golang.org/x/crypto/ssh: Invoking VerifiedPublicKeyCallback permissions skip enforcement
CVE-2026-46595
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of cal
golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @revoked status
CVE-2026-42508
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and
golang.org/x/crypto/ssh vulnerable to infinite loop on large channel writes
CVE-2026-39834
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload
golang.org/x/crypto/ssh: FIDO/U2F security key physical presence check can be bypassed
CVE-2026-39831
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did
golang.org/x/crypto/ssh: Invoking client can cause server deadlock on unexpected responses
CVE-2026-39830
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection
golang.org/x/crypto/ssh/agent doesn't drop invoking agent constraints when forwarding keys
CVE-2026-39832
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serializ