Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.
CVE-2026-41563
Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.
#severity:high
共收录 5417 条相关情报。
← 返回所有主题Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.
CVE-2026-39760
Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.
Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+...
CVE-2026-0461
Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices co
simple-git allows command execution through unblocked Git configuration includes
CVE-2026-102826
## Summary An OS command injection vulnerability in `git.clone()` allows any application that flows attacker-influenced
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
CVE-2026-102827
simple-git's blockUnsafeOperationsPlugin blocks dangerous git options (--upload-pack/--receive-pack/--exec/...) unless t
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
CVE-2026-96749
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
CVE-2026-96748
### Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
CVE-2026-102600
### Impact This is a **prototype pollution / improper client lookup** vulnerability in `@socket.io/cluster-engine`. Se
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
CVE-2026-104845
# Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element c
@nx/docker: OS command injection in the @nx/docker release pipeline
CVE-2026-104859
## Summary The `@nx/docker` release pipeline builds its `docker` invocations as shell command strings, interpolating `r
Nx: OS command injection via git revisions and remote refs
## Summary Nx core builds several `git` invocations as shell command strings with untrusted values interpolated into th
Nx daemon and plugin worker sockets are accessible to other local users
CVE-2026-104854
## Summary Nx creates the Unix domain sockets for its daemon and its plugin workers in a shared temporary directory wit
compression vulnerable to Denial of Service via memory leak on premature response close
CVE-2026-87776
### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconne
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
CVE-2026-100722
## Summary An untrusted script run by `VM.run` can construct an embedder-exposed host function that returns a rejected
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
CVE-2026-103921
## Impact `buildWSLegacyExecutor()` in `@graphql-tools/executor-legacy-ws` previously hardcoded `rejectUnauthorized: fa
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
CVE-2026-104852
Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hiv
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded...
CVE-2026-105295
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories()...
CVE-2026-105220
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup fro
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in...
CVE-2026-105219
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2...
CVE-2026-105213
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only