heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map...
CVE-2026-100864
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback re
#severity:high
共收录 5366 条相关情报。
← 返回所有主题Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition...
CVE-2026-100865
Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition evaluator uses Python eval(
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials...
CVE-2026-100859
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that all
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote...
CVE-2026-100848
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syn
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai...
CVE-2026-100844
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_run
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station...
CVE-2026-100855
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password...
CVE-2026-100856
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete mig
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level...
CVE-2026-100853
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allow
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of...
CVE-2026-100847
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListA
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the...
CVE-2026-100846
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config...
CVE-2026-100852
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recordi
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station...
CVE-2026-100849
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/...
CVE-2026-100851
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter:...
CVE-2026-100857
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails t
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail...
CVE-2026-100833
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all containe
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination...
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weight
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0...
CVE-2026-100834
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest...
CVE-2026-100839
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML hand
MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle...
CVE-2026-100843
MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsa
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in...
CVE-2026-100842
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. Th