PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in...

CVE-2021-47966

PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid paramet

历史摘要 · 未重新核验 · GitHub Advisory

WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows...

CVE-2021-47959

WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exh

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

CVE-2026-45578

## Summary **Type:** Classic shell-metacharacter injection. The YPTSocket notification branch in `plugin/Live/on_publis

历史摘要 · 未重新核验 · GitHub Advisory

Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

CVE-2026-45575

### Impact An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substi

历史摘要 · 未重新核验 · GitHub Advisory

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that...

CVE-2026-8695

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers t

历史摘要 · 未重新核验 · GitHub Advisory

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x...

CVE-2026-35194

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated u

历史摘要 · 未重新核验 · GitHub Advisory

epa4all-client: TLS Certificate Validation Disabled in Production

CVE-2026-45574

### Impact An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (se

历史摘要 · 未重新核验 · GitHub Advisory

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shar...

## Summary **Type:** Authorization-bypass via user-controlled identifier. The Meet plugin's recorded-video upload endpo

历史摘要 · 未重新核验 · GitHub Advisory

SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

CVE-2026-46491

## Summary `simplesamlphp-module-casserver` builds file paths for the file-based CAS ticket store by directly concatena

历史摘要 · 未重新核验 · GitHub Advisory

Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

CVE-2026-44692

Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then re

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasourc...

CVE-2026-45717

## Summary Budibase exposes a REST API for datasource management. The route `PUT /api/datasources/:datasourceId` is reg

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

CVE-2026-45715

### Summary The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an au

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

CVE-2026-45548

## Vulnerability Details **CWE-918**: Server-Side Request Forgery (SSRF) The `processUrlFile` function in `packages/se

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

CVE-2026-45364

### Am I affected? Users are affected if all of the following are true: - Their app uses `better-auth` at a version `<

历史摘要 · 未重新核验 · GitHub Advisory

goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request

### Summary The `--tunnel` / `-t` flag opens an outbound SSH connection to `localhost.run:22` with `HostKeyCallback: ss

历史摘要 · 未重新核验 · GitHub Advisory

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

CVE-2026-45062

### Summary The `splitPos()` function in [`cgi.go`](https://github.com/php/frankenphp/blob/main/cgi.go) misuses `golang

历史摘要 · 未重新核验 · GitHub Advisory

Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

CVE-2026-44716

## Summary A path traversal vulnerability exists in Pipecat's development runner (`src/pipecat/runner/run.py`). When th

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

CVE-2026-41147

### Impact NukeViet CMS `, which are stored server-side and executed in the browser of any user who views the content.

历史摘要 · 未重新核验 · GitHub Advisory

nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

CVE-2026-40092

### Impact A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing

历史摘要 · 未重新核验 · GitHub Advisory

@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files

CVE-2026-22810

### Summary A path traversal vulnerability in the OneNote importer allows overwriting arbitrary files on disk. ### Deta

历史摘要 · 未重新核验 · GitHub Advisory