LibreNMS Vulnerable to Remote Code Execution via AboutController

# Remote Code Execution via AboutController in LibreNMS ## Summary A Remote Code Execution (RCE) vulnerability exists

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

CVE-2026-71322

## Summary The `CertificateExport` handler in `lemur/certificates/views.py` nests its entire ownership / `CertificateP

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

CVE-2026-71317

## Summary Repo under test: https://github.com/Netflix/lemur When `ADMIN_ONLY_AUTHORITY_CREATION=False` (an explicitly

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

CVE-2026-70667

## Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (`_validate_revocation_url()` in `lemur /certificates/verif

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection

CVE-2026-55593

## Summary The Froxlor AJAX endpoint (`lib/ajax.php`) is missing Cross-Site Request Forgery (CSRF) protection. While th

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

CVE-2026-54543

Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into gene

历史摘要 · 未重新核验 · GitHub Advisory

devpi-server may leak database contents

CVE-2026-54723

### Impact If the replication protocol is enabled by using the ``primary`` (or deprecated ``master``) role for a server

历史摘要 · 未重新核验 · GitHub Advisory

Triton VM Soundness Vulnerability due to Missing Constraint

The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location.

历史摘要 · 未重新核验 · GitHub Advisory

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

CVE-2026-53423

### Summary `membrane_mp4_plugin` interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, wit

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1...

CVE-2026-75080

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects s

历史摘要 · 未重新核验 · GitHub Advisory

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This...

CVE-2026-75079

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unkno

历史摘要 · 未重新核验 · GitHub Advisory

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce...

CVE-2026-9859

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles o

历史摘要 · 未重新核验 · GitHub Advisory

This vulnerability only affects Grafana stacks configured with multiple organizations; single...

CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments a

历史摘要 · 未重新核验 · GitHub Advisory

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate...

CVE-2026-10080

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field ty

历史摘要 · 未重新核验 · GitHub Advisory

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

CVE-2026-69146

### Summary When MLflow is deployed with the built-in basic-auth plugin (`--app-name basic-auth`), any authenticated us

历史摘要 · 未重新核验 · GitHub Advisory

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

CVE-2026-54147

### Impact An issue in `DigestAuthProvider.verify`: **Algorithm silently forced to MD5.** The configured `algorithm`

历史摘要 · 未重新核验 · GitHub Advisory

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

CVE-2026-53766

### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP

历史摘要 · 未重新核验 · GitHub Advisory

package pkcs12: Authentication bypass in Decode functions

`Decode`, `DecodeChain`, `DecodeTrustStore`, and `ToPEM` can incorrectly accept PKCS#12 files which were encoded with th

历史摘要 · 未重新核验 · GitHub Advisory

powerlevel10k fails to neutralize control characters in the package.json version field when...

CVE-2026-75483

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt

历史摘要 · 未重新核验 · GitHub Advisory

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN...

CVE-2026-75108

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any

历史摘要 · 未重新核验 · GitHub Advisory