30121 matches found
PT-2026-34074
Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.45 MySQL Server versions 8.4.0 through 8.4.8 MySQL Server versions 9.0.0 through 9.6.0 Description An issue exists in the Server: Optimizer component of MySQL Server. A high privileged attacker with...
PT-2026-34094
Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.45 MySQL Server versions 8.4.0 through 8.4.8 MySQL Server versions 9.0.0 through 9.6.0 Description An issue exists in the Group Replication Plugin of MySQL Server. A low-privileged attacker with network...
Oracle Enterprise Manager Base Platform å®å Øę¼ę“
Oracle Enterprise Manager Base Platform is a local management platform developed by Oracle Corporation in the United States. This platform is primarily used for managing the deployment of Oracle products. Versions 13.5 and 24.1 of Oracle Enterprise Manager Base Platform contain security...
PT-2026-34140
Name of the Vulnerable Software and Affected Versions MySQL Shell versions 8.0.0 through 8.0.45 MySQL Shell versions 8.4.0 through 8.4.8 MySQL Shell versions 9.0.0 through 9.6.0 Description An issue in the Shell: Core Client component allows a high-privileged attacker with network access via...
PT-2026-34153
Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.45 MySQL Server versions 8.4.0 through 8.4.8 MySQL Server versions 9.0.0 through 9.6.0 Description An issue exists in the InnoDB component of MySQL Server. A high-privileged attacker with network access...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Optimizer component. An attacker can cause the server to hang or crash repeatedly by sending specially crafted requests over the network. This is only exploitable if the...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the InnoDB component. An attacker can cause the server to hang or repeatedly crash by sending specially crafted requests over the network. This is only exploitable if the attacker...
EUVD-2026-24012
OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch calls to access internal resources or interact with external...
GHSA-QC5J-2MQX-X83Q Duplicate Advisory: OpenClaw: Webchat media embedding enforces local-root containment for tool-result files
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mr34-9552-qr95. This link is maintained to preserve external references. Original Description OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowi...
CVE-2026-34428 Vvveb < 1.0.8.1 SSRF via oEmbedProxy
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read...
PT-2026-36837
Name of the Vulnerable Software and Affected Versions D-Link DIR-456U Hardware Revision A1 Description The device contains a hardcoded telnet backdoor. At boot, a telnet daemon is started via the script '/etc/init0.d/S80telnetd.sh' using the username "Alphanetworks" and a static password "whdrv01...
Server-side Request Forgery (SSRF)
Overview @nocobase/plugin-workflow-request is a Send HTTP requests to any HTTP service for data interaction in workflow. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the workflow HTTP request and custom request plugins, which make server-side HTTP...
CVE-2026-40346 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An...
DNS Rebinding
Overview openclaw is a š¦ OpenClaw ā Personal AI Assistant Affected versions of this package are vulnerable to DNS Rebinding via improper hostname validation in the browser navigation policy. An attacker can access internal network resources or sensitive endpoints by exploiting DNS rebinding...
CVE-2026-6284 Horner Automation Cscape and XL4, XL7 PLC Weak password requirements
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
CVE-2026-6284
CVE-2026-6284 affects Horner Automation PLC products (Cscape software and XL4/XL7 XL-series PLCs). Vulnerability stems from weak password requirements: limited password complexity and no input-rate limits enable network-auth brute-forcing to gain unauthorized access to systems and services. Attac...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...
Flowise Execute Flow function has an SSRF vulnerability
Summary The attacker provides an intranet address through the base url field configured in the Execute Flow node ā Bypass checkDenyList / resolveAndValidate in httpSecurity.ts not called ā Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detec...
