IOPaint 路径遍历漏洞

IOPaint is an AI-based image restoration and content generation tool developed by Qing. Version 1.5.3 of IOPaint contains a path traversal vulnerability, which stems from incorrect handling of the parameter filename in the file iopaint/filemanager/filemanager.py. This vulnerability may lead to pa...

PT-2026-29829

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.97 Description An authentication bypass exists in the multi-agent teams system where the validate token function within OAuthManager returns True for any token not found in its internal store, which is empty by...

PT-2026-29565

An unauthenticated remote code execution RCE vulnerability exists in applications that use the Replicator node package manager npm version 1.0.5 to deserialize untrusted user input and execute the resulting object...

PT-2026-29575

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulnerability allows unauthenticated users to retrieve password-protected shared PDFs by directly calling the file-serving endpoint without...

Cisco Smart Software Manager On-Prem 安全漏洞

Cisco Smart Software Manager On-Prem is a component developed by Cisco, Inc., used for managing licenses of Cisco products. Cisco Smart Software Manager On-Prem has a security vulnerability that arises from the unintentional exposure of internal services, which may allow unverified remote attacke...

Cisco Smart Software Manager On-Prem 安全漏洞

Cisco Smart Software Manager On-Prem is a component developed by Cisco, Inc., used for managing licenses of Cisco products. Cisco Smart Software Manager On-Prem has a security vulnerability that stems from improper transmission of sensitive user information. This vulnerability could allow...

Python Install Manager 安全漏洞

Python Install Manager is an open-source installation management tool for Python. Python Install Manager has a security vulnerability that stems from including the current working directory in the sys.path, which may allow malicious modules to be imported from a directory controlled by the attack...

PT-2026-29561

A vulnerability in the web interface of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this...

PT-2026-29563

Name of the Vulnerable Software and Affected Versions Cisco Smart Software Manager On-Prem versions 9-202502 through 9-202510 Description A vulnerability in Cisco Smart Software Manager On-Prem SSM On-Prem allows an unauthenticated, remote attacker to execute arbitrary commands on the underlying...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-1499)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1499 advisory. cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Tenable has extracted the...

GHSA-J7P2-QCWM-94V4 OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

Summary Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior. Impact An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled...

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

Summary Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior. Impact An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-41332 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-41332 Source advisory: SNYK:JS-OPENCLAW-15864694...

CVE-2026-4668

CVE-2026-4668 concerns the Amelia Booking for WordPress plugin. In all versions up to 2.1.2, the payments listing endpoint is vulnerable to SQL Injection via the sort parameter. The root cause is insufficient escaping and direct interpolation of the user-supplied sort field into an ORDER BY claus...

CVE-2026-4668 Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the sort parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied sort parameter and lack of...

CVE-2026-4668

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the sort parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied sort parameter and lack of...

CVE-2026-5215

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function...

CVE-2026-5214

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function...

EUVD-2026-17613

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function...

CVE-2025-15379

A flaw was found in MLflow. When deploying a model with envmanager=LOCAL, MLflow's model serving container initialization code, specifically the installmodeldependenciestoenv function, reads dependency specifications from the model artifact's pythonenv.yaml file. An attacker can supply a maliciou...