CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
CVE-2026-48062
### Impact The `ext_in` upload validation rule checked the MIME-derived guessed extension instead of the client-provided
#severity:critical
共收录 1443 条相关情报。
← 返回所有主题SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote...
CVE-2026-38581
SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitra
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
CVE-2026-48039
# Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | -------------
QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS...
CVE-2025-66276
QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated...
CVE-2026-44963
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
CVE-2026-48030
### Summary An OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execu
PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
CVE-2026-8467
### Summary An unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code o
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect...
CVE-2026-48303
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerabil
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side...
CVE-2026-47938
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation...
CVE-2026-47928
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could re
shell-quote quote() does not escape newlines in object .op values
CVE-2026-9277
### Summary `shell-quote`'s `quote()` function did not validate object-token inputs against the operator model used by
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with...
CVE-2026-44748
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtai
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft...
CVE-2026-40128
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of...
CVE-2026-27671
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP
Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker...
CVE-2026-11671
Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to...
CVE-2026-11651
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code i
Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to...
CVE-2026-11638
Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a s
Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote...
CVE-2026-11634
Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially p
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
CVE-2026-47724
The `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself adm
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
CVE-2026-47252
# AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin | Field | Value | | --------------