CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

EUVD-2026-95132

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

CVE-2026-97147

The OpenStack Mistral service (through version 23.0.0 ) contains an incorrect authorization vulnerability in several v2 API write paths . The root cause is that these paths resolve target objects using a query that can return resources belonging to different projects, subsequently allowing unauth...

CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

CVE-2026-93860

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenanc...

CVE-2026-93860

OpenStack Mistral versions through 23.0.0 are vulnerable to an authentication bypass issue in the /v2/maintenance API controller. The controller clears the request context and interacts with the maintenance service without enforcing security policies. Consequently, any user with a valid Mistral t...

CVE-2026-93860

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenanc...

CVE-2026-93860

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenanc...

cart

CaRT（压缩与 RC4 传输） CaRT 文件格式用于存储/传输恶意软件及其相关元数据。它会使恶意软件失效，使其无法执行，并对其进行加密，从而避免杀毒软件将 CaRT 文件标记为恶意软件。 优势 快速：CaRT 与压缩文件一样快 流式处理：CaRT 使用 zlib 和 RC4，支持对流式数据进行编码 元数据：CaRT 可以将文件元数据与文件本身存储在同一个文件中，无需读取整个文件即可读取元数据 哈希计算：CaRT 在编码文件的同时计算文件的哈希值，并将该信息存储在页脚中 体积：由于使用了压缩，CaRT 文件通常比原始文件更小。（除非在 CaRT 中存储了大量元数据） 将 CaRT 与...

CVE-2020-10257

/ \ \ / /|| \ / |/ | | | \ V /| | / / / / || | / /| \ / / | / | | / / / || /| /// by darkcast CVE-2020-10257：WordPress TRX Addons 插件未授权远程代码执行（RCE）漏洞 受影响插件：TRX Addons 漏洞类型：未授权远程代码执行（RCE） CVSS 评分：9.8（严重） 受影响版本：2.5.1 之前版本 补丁可用：是（更新至 2.5.1 或更高版本） 描述： CVE-2020-10257 影响 WordPress 的 TRX Addons 插件，这是一个用于...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Honor Magic V2 ハイパーバイザー検出スイート ➲ プロジェクト概要 SENTINEL-ROOT-AUDIT は、Honor Magic V2（SM8550）上でカーネル整合性を監査し、ハイパーバイザーレベルの介入を検出するために設計されたプロフェッショナルグレードのセキュリティスイートです。 コア脆弱性（CVE-2025-38352）はカーネル内でOOB読み取り/書き込み プリミティブを可能にしますが、このスイートは「多層防御」の側面に焦点を当てており、最新のハードウェアレベル保護（EL2...

flask-vuln-v2

このリポジトリには README がありません。...

PT-2026-108119

CVE ID: CVE-2026-97147 Severity: UNKNOWN Severity and score come from CVSS ratings in the National Vulnerability Database NVD, the NIST repository of standardized vulnerability data. In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that...

EUVD-2026-92788

Langflow: OS command injection RCE via arbitrary command in MCP stdio server configuration...

CVE-2026-46438

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438

In versions prior to 2.6 , the wger fitness manager is vulnerable to a cross-user data corruption flaw. An authenticated attacker can inject arbitrary workout log entries into another user's SlotEntry by submitting a POST /api/v2/workoutlog/ request with a victim's slot_entry ID. This is possible...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...