Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-56012
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Medi
#severity:high
共收录 5499 条相关情报。
← 返回所有主题ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code...
CVE-2026-53676
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed c
When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an...
CVE-2026-50107
When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerabilit
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service...
CVE-2026-55199
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SS
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated...
CVE-2026-49133
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level pri
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the...
CVE-2026-55201
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header...
CVE-2026-55202
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection,
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with...
CVE-2026-32682
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI...
CVE-2026-10696
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier all
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the...
CVE-2026-53871
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that ac
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated...
CVE-2026-11407
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attacker
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session...
CVE-2026-55197
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows aut
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that...
CVE-2026-53869
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export...
CVE-2026-55198
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows a
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
CVE-2026-55470
## Summary The fix for CVE-2026-45367 added `RegexTimeout` protection to the `matches()` function in DSTU2016MAY, DSTU3,
handlebars.java FileTemplateLoader Path Traversal
CVE-2026-55760
### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or Clas
Filament: Disabled RichEditor field state can be used for XSS
CVE-2026-55409
In Filament v3, a disabled `RichEditor` field rendered its raw state without sanitizing HTML. Where the data stored in t
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
CVE-2026-55405
### Summary The MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter **keys**
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for...
CVE-2026-5667
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan);
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI...
CVE-2026-7300
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web In