Vantage6: Set admin user and password from environment or configuration

### Impact Vantage6 currently provides an initial user with username `root` and password `root`. This is not ideal for t

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: OAuth Tokens Persist Through Security Events

### Summary OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password,

历史摘要 · 未重新核验 · GitHub Advisory

Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

CVE-2026-49343

## Summary The account-data trie syncers leak bounded throttler slots on error paths in `syncDataTrie()`. Each failed

历史摘要 · 未重新核验 · GitHub Advisory

Source controller: Improper path handling allows traversal

CVE-2026-47680

### Impact An actor with the ability to influence the contents of a bucket referenced by a `Bucket` resource can cause

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: OAuth Authorization Code Race Condition

CVE-2026-47386

### Summary Two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct va

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Path Traversal via SQLite Source Filename

CVE-2026-47385

### Summary An authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file o

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: SQL Injection via Column Title in Bulk GroupBy

CVE-2026-47384

### Summary An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Server-Side Request Forgery via Database Connection Host

CVE-2026-47382

### Summary The connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving an

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Cross-Workspace Integration Use in Connection Test

CVE-2026-47381

### Summary A user in one workspace could exercise another workspace's integration through the `testConnection` endpoint

历史摘要 · 未重新核验 · GitHub Advisory

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the ...

CVE-2026-8653

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in

历史摘要 · 未重新核验 · GitHub Advisory

OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing...

CVE-2026-10597

OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote a

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in ealpha072 Student-Management-System up to...

CVE-2026-10777

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Af

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate...

CVE-2026-10771

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-

历史摘要 · 未重新核验 · GitHub Advisory

Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an...

CVE-2026-22055

Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low p

历史摘要 · 未重新核验 · GitHub Advisory

Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an...

CVE-2026-22054

Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with l

历史摘要 · 未重新核验 · GitHub Advisory

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

CVE-2026-47265

### Summary Cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. ###

历史摘要 · 未重新核验 · GitHub Advisory

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields...

CVE-2026-42840

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and

历史摘要 · 未重新核验 · GitHub Advisory

An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML...

CVE-2026-42839

An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name,

历史摘要 · 未重新核验 · GitHub Advisory

Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands

CVE-2026-44022

### Impact The LaTeX backend's handling of `\includegraphics`, `\input`, and `\include` commands lacked path containment

历史摘要 · 未重新核验 · GitHub Advisory

Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

CVE-2026-44018

### Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling

历史摘要 · 未重新核验 · GitHub Advisory