HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command...
CVE-2026-7551
HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders
#severity:high
共收录 5513 条相关情报。
← 返回所有主题IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary...
CVE-2026-6543
IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges o
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the...
CVE-2026-7435
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client...
CVE-2026-33451
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to 14.50. Attackers w
IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view...
CVE-2026-4503
IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to
CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50....
CVE-2026-40950
CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of
Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume...
CVE-2026-7461
Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amaz
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
CVE-2026-42137
### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access or l
Contras Affected by CopyFile Policy Subversion via Symlinks
### Impact The [Kata agent policies](https://docs.edgeless.systems/contrast/architecture/components/policies) generated
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)
CVE-2026-42461
### Summary Four `GET` endpoints under `/api/templates*` in Arcane's Huma backend are registered without any `Security`
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U...
CVE-2026-36960
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability...
CVE-2022-50992
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet i
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can...
CVE-2025-51846
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade o
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero...
CVE-2026-33845
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an i
Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege...
CVE-2026-5174
Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary...
CVE-2026-36340
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose e
Improper Restriction of XML External Entity Reference vulnerability in Connext Professional (Core...
CVE-2025-14543
Improper Restriction of XML External Entity Reference vulnerability in Connext Professional (Core Libraries) allows Seri
Clerk has an authorization bypass when combining organization, billing, or reverification checks
CVE-2026-42349
### Summary `has()`, `auth.protect()`, and related authorization predicates in `@clerk/shared`, `@clerk/nextjs`, `@cler
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
CVE-2026-42449
### Impact In the SDK embedder path (`N8NDocumentationMCPServer` constructor, `getN8nApiClient()`, and `validateInstanc
Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation
# Summary The Hickory DNS project's experimental `hickory-recursor` crate's record cache (`DnsLru`) stores records from