File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
CVE-2026-91127
### Summary Before 2.3.1, the legacy `.doc` renderer emitted document hyperlink targets after HTML escaping but without
#severity:high
共收录 5373 条相关情报。
← 返回所有主题adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
CVE-2026-77301
### Summary adm-zip allocates an entry's output buffer from the declared uncompressed size (central-directory `size` fie
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
CVE-2026-81505
## Summary frain-dev/convoy (all versions up to and including v26.6.2, no patch available) lets any authenticated caller
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
CVE-2026-63349
AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process()
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
CVE-2026-58197
## Summary A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
CVE-2026-61833
### Summary A bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot re
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
CVE-2026-61672
## Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on thei
LMDeploy has an SSRF bypass
### Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF a
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
CVE-2026-33625
### Summary lmdeploy <= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that al
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
### Summary The `api.php?action=smwtask` API module performs no authorization check. The equivalent maintenance interfa
The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote...
CVE-2026-93468
The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit R
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views,...
CVE-2026-93455
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff acc
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages...
CVE-2026-93456
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC)...
CVE-2026-79954
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiv
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress...
CVE-2026-93452
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that wr
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON...
CVE-2026-93450
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serializatio
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as...
CVE-2026-93453
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing u
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized...
CVE-2026-85887
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose informat
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference...
CVE-2026-93436
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode di
Local privilege escalation due to insecure file permissions. The following products are affected:...
CVE-2026-87886
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin