PHPSpreadsheet has a patch bypass for CVE-2026-34084
CVE-2026-45034
## Summary CVE-2026-34084 was patched by the helper `File::prohibitWrappers`. The helper calls `parse_url($filename, PH
#severity:critical
共收录 1443 条相关情报。
← 返回所有主题WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability...
CVE-2024-58348
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticate
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated...
CVE-2023-54352
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbit
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows...
CVE-2024-58349
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta...
CVE-2025-1740
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypas
A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise...
CVE-2026-11429
A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. Th
A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due...
CVE-2026-11423
A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass...
CVE-2026-10580
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrat
A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in...
CVE-2026-11414
A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Beca
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise...
CVE-2026-11420
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauth
A path traversal vulnerability exists in the Altium Enterprise Server Vault Service...
CVE-2026-11419
A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper val
Shopper: Authorization bypass and RBAC privilege escalation in team settings
CVE-2026-47744
## Impact Two distinct authorization defects in the team settings allowed any authenticated panel user to take over the
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that...
CVE-2025-71317
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative acce
NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A...
CVE-2025-71318
NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
CVE-2026-47731
## 1. Summary The Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating pa
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
CVE-2026-47670
### Summary DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials c
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
CVE-2026-47669
The `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
CVE-2026-47668
### Summary DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
CVE-2026-44182
### Summary The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabli
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
CVE-2026-44181
### Summary The environment variables (`KERNEL_XXX`) used during the rendering of the Kubernetes manifest are vulnerabl