OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows...

CVE-2026-8659

OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to exe

历史摘要 · 未重新核验 · GitHub Advisory

ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This...

CVE-2026-9775

ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attack

历史摘要 · 未重新核验 · GitHub Advisory

OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows...

CVE-2026-8663

OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execut

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for...

CVE-2026-13208

A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SE

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in KubeVirt's safepath package. The OpenAtNoFollow function uses O_PATH...

CVE-2026-13201

A flaw was found in KubeVirt's safepath package. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file des

历史摘要 · 未重新核验 · GitHub Advisory

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a...

CVE-2026-13034

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had com

历史摘要 · 未重新核验 · GitHub Advisory

Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote...

CVE-2026-13030

Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potenti

历史摘要 · 未重新核验 · GitHub Advisory

Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0...

CVE-2026-13021

Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote

历史摘要 · 未重新核验 · GitHub Advisory

Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who...

CVE-2026-13023

Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the rend

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197...

CVE-2026-13024

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attac

历史摘要 · 未重新核验 · GitHub Advisory

A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid...

CVE-2025-60471

A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4B

历史摘要 · 未重新核验 · GitHub Advisory

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

CVE-2026-53541

### Description The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not ex

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

CVE-2026-55483

### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a no

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

CVE-2026-55482

### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Co

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT has a 2FA reset privilege bypass

CVE-2026-50550

### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT Vulnerable to User Account Escalation via CSV Import

CVE-2026-49976

### Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission

历史摘要 · 未重新核验 · GitHub Advisory

Flask-Security has an Open Redirect issue

# Open Redirect in Flask-Security ## Summary `flask_security.utils.validate_redirect_url()` can allow an attacker-cont

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

CVE-2026-49870

### Impact `POST /two-factor` had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

CVE-2026-49205

Missing Authorization in API CategoryController — CVE-2026-24421 fixed BackupController by adding userHasPermission(Per

历史摘要 · 未重新核验 · GitHub Advisory

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

## Summary If a symlink already exists under the `.terraform/providers` directory where a provider package needs to be

历史摘要 · 未重新核验 · GitHub Advisory