Dell PowerProtect Data Domain 安全漏洞

Dell PowerProtect Data Domain is a set of hardware devices developed by the American company Dell, used for data protection, backup, storage, and data deactivation. Vulnerabilities exist in versions 7.7.1.0 to 8.5 of Dell PowerProtect Data Domain, as well as in LTS2025 versions 8.3.1.0 to 8.3.1.2...

PT-2026-33538

Name of the Vulnerable Software and Affected Versions libgphoto2 versions prior to 2.5.34 Description An out-of-bounds read exists in the ptp unpack OI function within camlibs/ptp2/ptp-pack.c. The function validates that the len variable is less than PTP oi SequenceNumber 48, but it subsequently...

PT-2026-37026

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10 Description A plugin trust bypass exists where channel setup catalog lookups may resolve workspace plugin shadows before bundled channel plugins. This allows attackers to craft malicious workspace plugins...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNSERVER-16110989...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.5), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.5) +5 more potentially affected by CVE-2026-41478 via @saltcorn/data (>=1.0.0, <=1.4.5)

@saltcorn/data NPM version =1.0.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNDATA-16110991...

@paperclipai/server (>=2026.3.17-canary.2, <=2026.415.0-canary.7), companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3) +4 more potentially affected by unknown CVE via @paperclipai/db (>=2026.3.17-canary.2, <=2026.415.0-canary.7)

@paperclipai/db NPM version =2026.3.17-canary.2, =2026.3.17-canary.2, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: unknown CVE Source advisory: SNYK:JS-PAPERCLIPAIDB-16421449...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3346 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +735 more potentially affected by CVE-2026-6414 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0-beta.23, =1.0.3 and more Source cves: CVE-2026-6414 Source advisory: OSV:GHSA-X428-GHPX-8J92...

CVE-2026-40255 @adonisjs/http-server has an Open Redirect vulnerability

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect.back method reads the Referer header from the incoming HTTP...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1789 more potentially affected by CVE-2026-41312 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41312 Source advisory: SNYK:PYTHON-PYPDF2-16097902...

CVE-2026-40901

DataEase (open-source data visualization platform) versions 2.10.20 and earlier ship legacy velocity-1.7.jar pulling in commons-collections-3.2.1.jar containing InvokerTransformer gadget chain. Quartz 2.3.2 is bundled and deserializes JOB_DATA blobs from qrtz_job_details via ObjectInputStream wit...

EUVD-2026-23308

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement...

Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

Impact The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots . as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io,...

@aumoai/mcp-data-analyst (>=0.1.0, <=0.2.8), @geobio/code_execution_server (>=0.2.0, <=0.2.1) +35 more potentially affected by CVE-2026-39313 via mcp-framework (>=0.1.27, <=0.2.15)

mcp-framework NPM version =0.1.27, =0.1.0, =0.2.0, =1.0.11, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves: CVE-2026-39313 Source advisory: OSV:GHSA-353C-V8X9-V7C3...

GHSA-G857-HHFV-J68W Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Details A buffer overflow vulnerability exists in Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to...

CVE-2026-40778

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through = 1.1.2...

CVE-2026-40744

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through = 2.10.1.2...

DEBIAN-CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in lz4-java-1.8.0.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in lz4-java-1.8.0.jar Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via...

CVE-2026-27820

CVE-2026-27820 is a buffer overflow in the Ruby zlib interface’s Zlib::GzipReader caused by zstream_buffer_ungets not ensuring sufficient Ruby string capacity before memmove. Affected: zlib gem v3.2.0/3.2.1 and earlier (3.0.0 and below, 3.1.0/3.1.1, 3.2.0/3.2.1). Impact: memory corruption when bu...