When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule...
CVE-2026-8359
When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to
#severity:high
共收录 5513 条相关情报。
← 返回所有主题Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e.,...
CVE-2026-8360
Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWe
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18...
CVE-2026-4868
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 1
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
CVE-2026-45077
### Description `Symfony\Bridge\Monolog\Command\ServerLogCommand` (the `server:log` console command) is a development-t
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
CVE-2026-45067
### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
CVE-2026-44982
## Summary The CrowdSec AppSec component fails to read the HTTP request body for any request whose `Content-Length` is
Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
CVE-2026-44726
## Summary A flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in pl
An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1...
CVE-2026-5509
An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an admin
Command injection in Raynet rvia version 12.6.4392.49-amd64.deb allows adversaries to execute...
CVE-2026-38945
Command injection in Raynet rvia version 12.6.4392.49-amd64.deb allows adversaries to execute arbitrary Java code via a
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
CVE-2026-45617
## Summary The built-in `strip_html` filter in liquidjs uses a regex containing four lazy-quantified alternatives. When
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
CVE-2026-45368
### TL;DR This vulnerability affects all Kirby sites that allow the use of the `(link: …)` KirbyTag, the `link:` parame
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
CVE-2026-45357
## Summary The `date` filter's strftime implementation parses width specifiers like `%9999999d` and forwards the captur
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
CVE-2026-45260
### Summary Pimcore's WebDAV asset endpoint exposes a `MOVE` operation through `/asset/webdav{path}` without adding an a
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
CVE-2026-45162
# GM-374 ## Summary Multiple locations in Pimcore v11 call PHP's `unserialize()` on data from database columns and file
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
CVE-2026-45063
### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the c
Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers...
CVE-2026-6957
Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to constr
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-49046
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Dupli
Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file...
CVE-2026-48922
Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip
Agent Zero before version 1.15 contains a path traversal vulnerability that allows...
CVE-2026-47118
Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arb
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote...
CVE-2026-48545
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Spa