Portainer 安全漏洞

Portainer is a lightweight user management interface developed by Portainer, open source, for managing Docker environments and Docker hosts. There is a security vulnerability in Portainer. This vulnerability stems from insecure default settings that grant regular users access to the host’s file...

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that can be exploited by an attacker to read arbitrary host files, thereby stealing sensitive credentials and accessing critical data...

EUVD-2025-209437

A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read...

Progress OpenEdge 安全漏洞

Progress OpenEdge is an enterprise-level application development and database management platform provided by the American company Progress. There is a security vulnerability in Progress OpenEdge, which stems from improper authorization in the AdminServer component. This vulnerability could allow...

CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

CVE-2025-68697 Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...

CVE-2025-68697

CVE-2025-68697 affects self-hosted n8n prior to 2.0.0. In legacy (non-task-runner) JavaScript Code node mode, an authenticated user with workflow editing access can invoke internal helpers from within the Code node, enabling arbitrary read/write of the host filesystem (within configured OS/contai...

Grafana 8.0.x < 8.0.7 / 8.1.x < 8.1.8 / 8.2.x < 8.2.7 / 8.3.x < 8.3.1 Path Traversal

Grafana version 8.0.x prior to 8.0.7, 8.1.x prior to 8.1.8, 8.2.x prior to 8.2.7, and 8.3.x prior to 8.3.1 are vulnerable to a path traversal issue that could allow an attacker to read arbitrary files on the host system that Grafana has access to. A remote attacker could exploit this vulnerabilit...

DEBIAN-CVE-2024-23833

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefineversion=3.7.7 where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest...

Gladys Assistant Security Breach

Gladys Assistant is a source home assistant software from Gladys Assistant open source. A security vulnerability exists in Gladys Assistant v4.27.0 and earlier versions. An attacker can exploit the vulnerability to extract sensitive files from the host computer...

Medium: containerd

Issue Overview: A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on...

Medium: ecs-init, docker, runc, containerd

Issue Overview: A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on...

containerd 信息泄露漏洞

containerd is a container daemon from the Apache Foundation. The process is responsible for controlling the full cycle of containers on the host according to the RunC OCI specification. Apache containerd is vulnerable to an information disclosure vulnerability that could be exploited by an attack...

Kubevirt Elevation of Privilege Vulnerability

Kubevirt is a virtual machine manager. A security vulnerability exists in kubevirt 0.29 and earlier versions. An attacker can exploit this vulnerability to gain privileges to a VM process on a host system to read and modify any file on a system running VMI, affecting data confidentiality and...

Apache Ambari XML Injection Vulnerability

Apache Ambari is a set of tools for configuring, managing and monitoring Apache Hadoop clusters from the Apache Apache Software Foundation, USA. The tool supports visualization and analysis of job and task execution, support for system alerts, and more. An XML injection vulnerability exists in...

DEBIAN-CVE-2011-2178

The virSecurityManagerGetPrivateData function in security/securitymanager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary...