Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
CVE-2026-59723
### Summary The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accept
#severity:high
共收录 5373 条相关情报。
← 返回所有主题zbateson/mail-mime-parser has CRLF header injection via attachment filename
CVE-2026-61815
### Impact A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to b
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
CVE-2026-61816
### Impact An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that p
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
CVE-2026-61782
### Summary The default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interface
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
CVE-2026-57231
## Summary An container image that contains a environment variable with just a key and no value can trick podman into p
@bytebase/dbhub's read-only mode does not prevent database writes
CVE-2026-61788
### Summary Setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
CVE-2026-56744
Reported by @echennells (Eric Chennells). Migrated from public issue #191 to a private advisory. **Affected:** `@bsv/wa
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
CVE-2026-56738
## Summary The `StopWords::add()` method in phpMyFAQ builds a SQL `INSERT` statement using `sprintf()` and inserts the
phpMyFAQ's two-factor authentication login bypasses the password factor
CVE-2026-56737
### Summary The public two-factor verification endpoint `POST /check` logs a user in based **solely** on a valid 6-digit
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
CVE-2026-56736
### Summary A stored cross-site scripting (XSS) vulnerability in phpMyFAQ allows any unauthenticated user (or low-privil
langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
## Summary `langchain-nvidia-ai-endpoints` versions before 1.4.2 accepted local filesystem paths as image inputs for Vi
Language Servers for AWS vulnerable to arbitrary file write
CVE-2026-12958
## Summary Language Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementat
Language Servers for AWS Vulnerable to Arbitrary Code Execution
CVE-2026-12957
### Summary Language Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime t
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the...
CVE-2026-97056
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (wh
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3...
CVE-2026-92470
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits...
CVE-2026-82370
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attack
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain...
CVE-2026-81536
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive...
CVE-2026-81208
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to imp
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain...
CVE-2026-80423
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to...
CVE-2026-81537
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to