Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
CVE-2026-40171
### Impact A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authenticati
#severity:high
共收录 5513 条相关情报。
← 返回所有主题Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL
CVE-2026-39383
# CVE Report — Unauthenticated SSRF via Unfiltered Webhook URL in Gotenberg ## Severity | Field | Value
Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This...
CVE-2026-42799
Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vulnerability is associa
ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.
CVE-2026-22070
ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.
Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP...
CVE-2024-39847
Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. Thi
TLS protocol dissector heap overflow in Wireshark 4.6.0 to 4.6.4 allows denial of service and...
CVE-2026-5402
TLS protocol dissector heap overflow in Wireshark 4.6.0 to 4.6.4 allows denial of service and possible code execution
A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function...
CVE-2026-7470
A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function sub_427C3C of the file /
A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability...
CVE-2026-7418
A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability affects the function st
A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is...
CVE-2026-7420
A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of th
A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects...
CVE-2026-7419
A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CVE-2026-42031
### Impact A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
CVE-2026-42353
### Summary Versions of `i18next-http-middleware` prior to 3.9.3 pass the user-controlled `lng` and `ns` values from `g
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
CVE-2026-42352
### Impact OGC API - Process execution requests can use the `subscriber` object to requests to internal HTTP services.
pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider
CVE-2026-42351
### Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requ
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
CVE-2026-41680
### Summary A critical Denial of Service (DoS) vulnerability exists in `marked@18.0.0`. By providing a specific 3-byte i
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
CVE-2026-41670
## Summary The SAML IdP implementation in Admidio's SSO module uses the `AssertionConsumerServiceURL` value directly fr
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
CVE-2026-41669
## Summary The Admidio SAML Identity Provider implementation discards the return value of its `validateSignature()` met
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
CVE-2026-41660
## Summary A logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users
Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit...
CVE-2026-34965
Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection en
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal...
CVE-2018-25311
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows auth