211 matches found
CVE-2023-27524
CVE-2023-27524 Apache Superset 认证绕过 CVE-2023-27524 参考 https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/...
PT-2026-91424
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine...
CVE-2026-85306
Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5...
PT-2026-82711
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
CVE-2026-76314 Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect syst...
CVE-2026-17616
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...
EUVD-2026-47086
Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite component: Configuration. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...
tomcat: Apache Tomcat: Error condition not handled when configuring CRLs
A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...
D-Link DCS-5615 安全漏洞
The D-Link DCS-5615 is a high-speed network dome camera produced by D-Link Corporation. Version 1.01.00 of the D-Link DCS-5615 contains a security vulnerability. This vulnerability stems from incorrect operations with the file /etc/conf.d/boa/boa.conf in the Boa Webserver component, which may lea...
TOTOLINK AC1200 T8 安全漏洞
The TOTOLINK AC1200 T8 is an AC1200 dual-band Mesh wireless router produced by TOTOLINK Corporation. Version 4.1.5cu.8611 of the TOTOLINK AC1200 T8 contains a security vulnerability. This vulnerability stems from incorrect operations in the vsftpd component’s configuration file /etc/vsftpd.conf,...
CVE-2026-6132
A vulnerability was determined in Totolink A7100RU 7.4cu.2313b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. Remote exploitation of the attack is...
CVE-2022-49036
Synology Active Backup for Business Recovery Media Creator (before version 2.5.0-2081) is affected by an OpenSSL configuration vulnerability described as an inclusion of functionality from untrusted control sphere, enabling local users to execute arbitrary code via unspecified vectors. Affected c...
The vulnerability of the setPptpServerCfg() function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming software allows a perpetrator to execute arbitrary commands.
The vulnerability of the setPptpServerCfg function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming system is related to the lack of measures taken at the control level to protect data. Exploiting this vulnerability could allow an attacker to execute arbitrary...
CVE-2026-9534
A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument PIN can lead to os command injection. It is possible to launch the attack remotely. The...
PT-2026-42026
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...
Agent Zero 安全漏洞
Agent Zero is an artificial intelligence framework developed by Jan Tomášek. Version 0.9.8 of Agent Zero contains a security vulnerability, which stems from a flaw in the external MCP server configuration function. This vulnerability could allow attackers to execute arbitrary operating system...
CVE-2026-5852 Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection
A weakness has been identified in Totolink A7100RU 7.4cu.2313b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried out remotely. The...
EUVD-2026-17050
A security flaw has been discovered in Totolink A3300R 17.0.0cu.557b20221024. This vulnerability affects the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument qosupbw results in command injection. The attack can be execut...
OpenClaw 操作系统命令注入漏洞
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an operating system command injection vulnerability. The vulnerability stems from the safeBins configuration failing to properly filter constructed command special characters, commands, etc., which can...