195770 matches found
EUVD-2026-72854
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...
CVE-2026-77103
creationtimestamp| type| source ---|---|--- 2026-09-08 15:00:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/63375w6i6ovp4...
CVE-2026-12940-Langflow-Unauth-RCE
CVE-2026-12940 — Langflow OSS ≤ 1.10.1 未认证 RCE（MCP stdio 环境变量注入） 在 Langflow OSS 直至 1.10.1 的版本中存在未认证远程代码执行漏洞。用于保护 MCP stdio 服务器配置的环境变量黑名单（DANGEROUSENVVARS）遗漏了 SHELLOPTS、BASHOPTS 和 PS4。由于 MCP stdio 启动器会通过 bash -c 运行配置的命令，攻击者可以注入 SHELLOPTS=xtrace 以及 PS4 命令替换，并以 Langflow 进程用户的身份执行任意 shell 命令——无需有效的 M...
CVE-2026-78135
creationtimestamp| type| source ---|---|--- 2026-09-08 13:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muz5arz6362i 2026-09-11 04:07:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i4cwgybeay5qa...
CVE-2026-78131
creationtimestamp| type| source ---|---|--- 2026-09-08 13:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muz5arz6362i...
CVE-2026-40864
CVE-2026-40864 — 通过跨源表单 POST 绕过 JupyterHub XSRF（Sec-Fetch-Mode: no-cors） 严重级别 ：中等 CWE ：CWE-352 — 跨站请求伪造 XSRF 影响版本 ：jupyterhub 4.1.0 ≤ 版本 分配的模式——这恰恰是令牌本该阻止的经典 CSRF 向量。因此，任何接受简单表单体且仅依赖此 XSRF 检查的状态更改端点，都可被跨源伪造。 将其映射到实际端点：/hub/spawn（启动受害者的服务器）和 /hub/accept-share（让受害者接受攻击者服务器的共享）都是通过此检查的表单 POST。 影响...
CVE-2025-55182-analysis
Análisis Técnico de CVE-2025-55182: Mi Viaje de Investigación ⚠️ Aviso de Exención de Responsabilidad Importante Este documento describe mi proceso de investigación personal sobre CVE-2025-55182, incluyendo hallazgos confirmados y experimentos que realicé. Esto representa un relato honesto de mi...
CVE-2026-80219
A flaw in hawtio-operator (OpenShift cluster mode) allows OAuth token theft. The operator creates a cluster-scoped OAuthClient with GrantMethod: auto and no client secret (public client). Because redirect URIs are derived from an operator-created Route whose hostname is tenant-controlled via the ...
EUVD-2026-72687
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...
CVE-2026-56291.yaml
此存储库没有 README。...
CVE-2026-21628_PoC
此存储库没有 README。...
CVE-2026-77132
creationtimestamp| type| source ---|---|--- 2026-09-08 09:55:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ea6eeuqonpoxa 2026-09-08 13:30:23+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muz4ydwo2x2u...
CVE-2026-54477
CVE-2026-54477：管理面板缺少安全标头（点击劫持 / XSS） 公告 字段| 值 ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03（Gardyn IoT Hub） CVSS 3.1| 5.4（中危） 向量（3.1）| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 向量（4.0）| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CWE（CISA 分配）| CWE-644（HTTP 标头脚本语法中和不当）...
CVE-2026-71644
creationtimestamp| type| source ---|---|--- 2026-09-08 08:18:15+00:00| seen| https://gist.github.com/DongJiaxin0422/6c39c3c59236bc2c8ec4b4182284fa7e 2026-09-11 17:20:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb37uwjyp2f 2026-09-11 18:07:45+00:00| seen|...
CVE-2026-71641
creationtimestamp| type| source ---|---|--- 2026-09-08 07:35:49+00:00| seen| https://gist.github.com/DongJiaxin0422/91656fd120c49a779992aba62c1d58af...
CVE-2026-48888 WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0...
CVE-2025-47812
此存储库没有 README。...
K000163236: Node.js vulnerability CVE-2021-3918
Security Advisory Description json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' CVE-2021-3918 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has...