Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the...
CVE-2026-100719
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t
#severity:high
共收录 5373 条相关情报。
← 返回所有主题Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP...
CVE-2026-100715
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl...
CVE-2026-100717
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA...
CVE-2026-100711
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user p
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key...
CVE-2026-100708
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens)...
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender...
CVE-2026-100718
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH...
CVE-2026-100713
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cr
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an...
CVE-2026-100712
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET r
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of...
CVE-2026-100707
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist ...
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.2
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy...
CVE-2026-100703
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free...
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex patter
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such...
CVE-2026-100702
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, all
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the...
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyvern
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the...
CVE-2026-100693
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-litera
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink...
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopp
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js...
CVE-2026-100690
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.j
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules...
CVE-2026-100689
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodu
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
CVE-2026-57443
### Summary The AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email