3671 matches found
CVE-2026-22762
Dell Avamar Server and Avamar Virtual Edition, prior to 19.10 SP1 with CHF338912, are affected by an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability. A high-privilege attacker with remote access could potentially cause arbitrary file deletion. The CVSS 3...
GO-2026-4461 Antrea has invalid enforcement order for network policy rules caused by integer overflow in antrea.io/antrea
Antrea has invalid enforcement order for network policy rules caused by integer overflow in antrea.io/antrea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
CVE-2026-22795 affecting package hvloader for versions less than 1.0.1-17
CVE-2026-22795 affecting package hvloader for versions less than 1.0.1-17. A patched version of the package is available...
CVE-2026-1358
Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges. This could allow an unauthenticated user to potentially obtain remote code execution on the server...
CVE-2026-26005 ClipBucket v5 enables internal network scans via an SSRF vulnerability
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - 45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SS...
CVE-2026-23856
Dell iDRAC Service Module iSM for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module iSM for Linux, versions prior to 5.4.1.1, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to...
yoke 代码注入漏洞
Yoke is a Kubernetes package management tool developed by YokeCD. Versions of Yoke prior to 0.19.0 contained a code injection vulnerability. This vulnerability stemmed from the lack of proper URL validation in the Air Traffic Controller component, allowing users with the authority to create or...
QNAP Qsync Central 代码问题漏洞
QNAP Qsync Central is a cloud-based file synchronization service for NAS devices provided by QNAP Technology Co., Ltd. Versions of QNAP Qsync Central prior to 5.0.0.4 contained a code vulnerability caused by a null pointer dereferencing, which could lead to a denial-of-service attack...
QNAP Systems File Station 路径遍历漏洞
QNAP Systems File Station is an archiving tool under the QTS platform developed by QNAP Systems. This application allows access to NAS files via a web interface. Versions of QNAP Systems File Station prior to 5.5.6.5190 contained a path traversal vulnerability. This vulnerability could lead to th...
OpenClaw OS Command Injection Vulnerability
OpenClaw is openclaw open source an intelligent artificial assistant. An operating system command injection vulnerability exists in versions prior to OpenClaw 2026.1.29, which stems from the sshNodeCommand function failing to properly filter construct command special characters, commands, etc. An...
LangChain 代码问题漏洞
LangChain is an open-source framework developed by LangChain for creating applications powered by large language models LLMs. Versions of LangChain prior to 1.1.14 contained code vulnerabilities. These vulnerabilities stemmed from insufficient URL validation in the RecursiveUrlLoader class within...
GitLab 安全漏洞
GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Prior to GitLab CE/EE 18.8.4, there was a security vulnerability. This...
PT-2026-7249
Name of the Vulnerable Software and Affected Versions syngo.plaza versions prior to VB30E HF07 Description The application does not properly encrypt passwords. This could allow an attacker to recover original passwords and potentially gain unauthorized access. Recommendations Update to version...
CVE-2026-22991 affecting package kernel for versions less than 6.6.121.1-1
CVE-2026-22991 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...
firefox: thunderbird: Information disclosure in the Networking component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking component...
FreeRDP 资源管理错误漏洞
FreeRDP is an open-source implementation of the Remote Desktop Protocol RDP by the FreeRDP team. Versions of FreeRDP prior to 3.22.0 contained a resource management vulnerability. This vulnerability stemmed from the use of urbselectinterface, which released the device’s MS configuration when an...
FreeRDP 资源管理错误漏洞
FreeRDP is an open-source implementation of the Remote Desktop Protocol RDP by the FreeRDP team. Versions of FreeRDP prior to 3.22.0 contained a resource management vulnerability. This vulnerability stemmed from the use of ainputsendinputevent to cache channelcallback in local variables, which...
CVE-2026-25560 WeKan < 8.19 LDAP Authentication Filter Injection
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication...
CVE-2025-64175 Gogs Vulnerable to 2FA Bypass via Recovery Code
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code e.g., from their own account to...