JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability...
CVE-2026-54390
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticate
#severity:critical
共收录 1441 条相关情报。
← 返回所有主题The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...
CVE-2026-54103
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...
CVE-2026-38717
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the...
CVE-2026-55203
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user...
CVE-2026-56020
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL clie
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...
CVE-2026-38716
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...
CVE-2026-38715
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...
CVE-2026-38714
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
### Summary The Docker API server accepted a request-supplied `browser_config.extra_args`, which flowed into Chromium's
Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE
### Summary When the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input
@acastellon/auth: Authentication bypass via spoofable headers in validateToken()
@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable a
netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
## REST Path Traversal Bypasses Token Redaction in netlicensing-mcp ### Summary The `netlicensing_get_product` MCP too
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink...
CVE-2026-12569
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vul
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple...
CVE-2026-54388
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers w
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length...
CVE-2026-54387
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding:
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in...
CVE-2026-55200
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() t
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey...
CVE-2026-55196
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allo
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
CVE-2026-55518
## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resource
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
CVE-2026-55471
### Summary `org.hl7.fhir.utilities.XsltUtilities` exposes two parallel families of XSLT transform helpers. The `transf
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
CVE-2026-55450
### Summary Unauthenticated users can upload any amount of data to the server without any limitations. No need for any p