Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...
CVE-2026-73883
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported ver
#severity:high
共收录 5387 条相关情报。
← 返回所有主题Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...
CVE-2026-73875
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported ver
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...
CVE-2026-73876
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported ver
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...
CVE-2026-73879
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported ver
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...
CVE-2026-73878
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported ver
moby/go-archive: Crafted tar archive can write outside the extraction directory
CVE-2026-17106
### Summary The tar extraction routines in `moby/go-archive` (`Unpack`, `UnpackLayer`, `Untar`/`UntarUncompressed`, and
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
### Summary The Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and versio
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
CVE-2026-71417
## Summary Repo under test: https://github.com/Netflix/lemur `PUT /api/1/certificates//revoke` authorizes the caller a
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
CVE-2026-71308
## Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a `rep
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
CVE-2026-71307
### Summary Lemur's destination read endpoints -- `GET /api/1/destinations` and `GET /api/1/destinations/` -- return the
Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
CVE-2026-71303
### Summary The fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIREC
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
CVE-2026-70666
### Summary The ACME client (used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs) connec
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
CVE-2026-54348
### Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
CVE-2026-54347
### Summary A stored Cross-Site Scripting (XSS) vulnerability in Froxlor's DNS editor allows an authenticated user with
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
CVE-2026-55224
## Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall ### Summary The app-store plugin service conca
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
### Summary The `NumpyReader` class in `monai/data/image_reader.py` unconditionally uses `np.load(name, allow_pickle=Tr
MONAI vulnerable to OS command injection
### Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after sub
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
## Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in `algo_from_pickle()` was fixed in
MeshCentral has unsanitized data fields
### Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) f
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate...
CVE-2026-9816
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields