A critical authorization bypass vulnerability exists in the Management Server handling of Brocade...
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions bef
#severity:high
共收录 5417 条相关情报。
← 返回所有主题In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments...
CVE-2026-102488
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly pri
A command injection vulnerability in the REST API management interface of Brocade Fabric OS...
CVE-2026-87680
A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allow
Multiple OS Command Injection vulnerabilities exist in the management interface and session...
CVE-2026-87682
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Broca
An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation...
CVE-2026-87681
An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabri
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component...
CVE-2026-87683
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS ver
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage...
CVE-2026-82627
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for Wor
When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the...
CVE-2026-87679
When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supp
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries...
CVE-2026-105816
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form...
CVE-2026-89322
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
CVE-2026-61439
### Summary Injection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detecti
Ghost: Remote Code Execution via Bookmark Card Images
CVE-2026-105642
### Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user
Ghost: Stored XSS via Embed Card Previews
CVE-2026-105643
### Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, inc
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
CVE-2026-105744
### Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
CVE-2026-106451
### Summary When no system-installed `liblz4-java` is found, `net.jpountz.util.Native.load()` extracts the bundled nati
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
CVE-2026-105649
### Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitizatio
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
CVE-2026-105699
### Summary Langflow's project-scoped MCP transport authenticates the caller for the `project_id` in the connection URL,
Next.js has Server-Side Request Forgery in Image Optimization
CVE-2026-94483
## Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs)
Payload: SQL injection in SQLite/Postgres
CVE-2026-105856
### Impact An attacker who has read plus create or update access to a collection can submit a request that includes a S
Payload: Remote Code Execution through first-register
CVE-2026-105858
### Impact A crafted request to the public first-register operation can be used to perform a RCE exploit. **You are aff