Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...
CVE-2026-35066
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control vulnerability. A low privileged att
#severity:high
共收录 5509 条相关情报。
← 返回所有主题PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list,...
CVE-2025-71322
PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypas
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS...
CVE-2026-54415
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all pla
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection...
CVE-2026-11311
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX
A remote attacker can inject LDAP special characters into the Distinguished Name (DN)...
CVE-2026-49268
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm c
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication...
CVE-2026-32804
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication vulnerability. An unauthenticated a
An integer overflow in the mtar_next() function in src/microtar.c in rxi microtar 0.1.0 allows a...
CVE-2026-54417
An integer overflow in the mtar_next() function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to caus
Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.
CVE-2026-54193
Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-54813
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force S
Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced...
CVE-2026-54816
Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code
Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.
CVE-2026-52707
Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.
Dell PowerFlex Manager, version(s) Version prior to 4.8, contain(s) an Inclusion of Functionality...
CVE-2026-22283
Dell PowerFlex Manager, version(s) Version prior to 4.8, contain(s) an Inclusion of Functionality from Untrusted Control
A stack-based buffer overflow exists in the raw_to_header() function in src/microtar.c in rxi...
CVE-2026-55738
A stack-based buffer overflow exists in the raw_to_header() function in src/microtar.c in rxi microtar 0.1.0. The functi
Multer vulnerable to Denial of Service via deeply nested field names
CVE-2026-5079
### Impact Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The
Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
CVE-2026-28737
## Summary Me again. Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site sc
Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
CVE-2026-24791
## Summary Many authenticated self routes under `/api/v1/user/...` do not enforce the `public-only` token restriction.
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
CVE-2026-22555
## Summary The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` only checks `IsOrgMember()` when a user forks a r
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
CVE-2026-54018
### Summary The SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP ad
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
CVE-2026-54017
### Summary The terminal-server reverse proxy in `backend/open_webui/routers/terminals.py` does not fully confine the u
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
CVE-2026-53840
### Summary OpenClaw supports remote MCP Streamable HTTP servers with operator-configured custom headers. In affected r