CVE-2026-25565

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access...

CVE-2026-25859 WeKan < 8.20 Migration Functionality Insufficient Permission Checks

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...

PT-2026-6882

Name of the Vulnerable Software and Affected Versions yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 Description A weakness exists due to improper authorization within the User Management Endpoint component. The issue is related to the addUser, updateUser, and...

Wing FTP Server 跨站请求伪造漏洞

Wing FTP Server is an open-source, cross-platform FTP server software developed by Wing FTP Server. Versions of Wing FTP Server prior to 6.2.7 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from cross-site request forgery within the web management interface, whi...

PT-2026-6790

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.2.0 Description calibre is an e-book manager. A Server-Side Template Injection SSTI vulnerability exists in calibre’s Templite templating engine. This allows for arbitrary code execution when a user converts an eboo...

Payload 安全漏洞

Payload is a headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. Versions of Payload prior to 3.74.0 have a security vulnerability. This vulnerability stems from an insecure direct object reference within the payload-preferences collection. In environments...

Microsoft Semantic Kernel 路径遍历漏洞

Microsoft Semantic Kernel is a large-scale model orchestration framework developed by Microsoft Corporation. Versions of Microsoft Semantic Kernel prior to 1.70.0 contained a path traversal vulnerability, which was caused by an arbitrary file writing vulnerability in the SessionsPythonPlugin...

Sliver 路径遍历漏洞

Sliver is an open-source, cross-platform opponent simulation/red team framework developed by Bishop Fox. It can be used by organizations of various sizes for security testing. Versions of Sliver prior to 1.6.11 contained a path traversal vulnerability. This vulnerability stemmed from path travers...

Edimax BR-6288ACL 代码注入漏洞

The Edimax BR-6288ACL is a wireless router produced by Edimax Corporation. Versions of Edimax BR-6288ACL prior to 1.12 contained a code injection vulnerability. This vulnerability stemmed from incorrect handling of a parameter named manualssid in the file wizWISP24gmanual.asp, which could lead to...

PT-2026-6758

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Gogs versions 0.13.0 through 0.13.3 Description Gogs is a self-hosted Git service. A path traversal issue exists in the updateWikiPage function. An authenticated user with write access to a repository's wiki can...

NiceGUI 跨站脚本漏洞

NiceGUI is an easy-to-use, Python-based UI framework developed under the open source license. Versions of NiceGUI prior to 3.7.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the ui.markdown component, which allowed raw HTML to be passed through by default,...

SandboxJS 安全漏洞

SandboxJS is a security assessment tool developed by nyariv’s individual developer. Versions of SandboxJS prior to 0.8.29 contained a security vulnerability. This vulnerability stemmed from the use of hasOwnProperty to mask objects in the sandbox, allowing sandbox escape and disabling the prototy...

PT-2026-6812

Name of the Vulnerable Software and Affected Versions Wing FTP Server versions prior to 6.2.7 Description Wing FTP Server versions prior to 6.2.7 have a cross-site request forgery CSRF issue in the web administration interface. This allows attackers to delete administrative users by crafting a...

PT-2026-6701

Name of the Vulnerable Software and Affected Versions versions prior to 2026 affected versions not specified Description A heap-based buffer overflow vulnerability exists in the image module. Successful exploitation of this issue may affect availability. Recommendations At the moment, there is no...

PT-2026-6704

Name of the Vulnerable Software and Affected Versions versions prior to 2026 affected versions not specified Description A use-after-free UAF concurrency vulnerability exists within the graphics module. Successful exploitation of this issue may impact system availability. Recommendations At the...

CVE-2026-22801 affecting package libpng for versions less than 1.6.54-1

CVE-2026-22801 affecting package libpng for versions less than 1.6.54-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-58160 affecting package rpm-ostree for versions less than 2022.1-8

CVE-2025-58160 affecting package rpm-ostree for versions less than 2022.1-8. A patched version of the package is available...

CVE-2025-61107 affecting package frr for versions less than 8.5.5-5

CVE-2025-61107 affecting package frr for versions less than 8.5.5-5. A patched version of the package is available...

F5 Networks BIG-IP : BIG-IP Edge Client for Windows vulnerability (K000158931)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.6. It is, therefore, affected by a vulnerability as referenced in the K000158931 advisory. A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain...

WeKan 访问控制错误漏洞

WeKan is an open-source dashboard application developed by WeKan. Versions of WeKan prior to 8.20 contained a security vulnerability related to access control. This vulnerability stemmed from an unknown function in the models/boards.js file within the component’s REST endpoint, which had improper...