In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold...
CVE-2026-76353
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"
#severity:medium
共收录 5482 条相关情报。
← 返回所有主题In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can...
CVE-2026-76345
In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head cluster
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
CVE-2026-63123
### Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to ca
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
CVE-2026-59992
## Summary The production media handler shipped by `next-tinacms-s3` (`createMediaHandler` in `packages/next-tinacms-s3
BuildKit: Custom frontend could bypass Seccomp/AppArmor
CVE-2026-61711
### Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the b
SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
### Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the `SEARXNG_URL` e
Snipe-IT: Stored DOM XSS via table selected-count IDs
CVE-2026-61807
### Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and suppli
Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
CVE-2026-55703
### Impact Any activated account in a company can read every maintenance record for that company (asset tag, supplier, p
SearXNG MCP Server: Additional hardened-mode SSRF bypasses
CVE-2026-54689
## Summary `mcp-searxng` has a hardened-mode URL-reading feature intended to prevent `web_url_read` from reaching priva
SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)
CVE-2026-54688
Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87#issuecomment-4645453694 ### Summary The web_url_read tool
Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS
CVE-2026-53941
## Summary An unprivileged container can block all other containers from starting on the same host by placing a crafted
block_buffer: panic corrupts inline buffer position
### Summary A caught panic may leave the cursor position of `EagerBuffer` or `ReadBuffer` in a corrupted state; this in
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
CVE-2026-55236
## Summary In affected versions of `langgraph-api` (the LangGraph Server runtime), the run-creation path authorized the
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
CVE-2026-55235
## Summary In affected versions of `langgraph-api` (the LangGraph Server runtime), a run or cron could be created with
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-66603
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-27365
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Publi
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is...
CVE-2025-11729
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized acc
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly...
CVE-2026-66589
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Sec
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-66591
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...
CVE-2026-73932
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported ver