CVE-2026-72691

OpenSignLabs opensignserver (up to version 2.37.0) has an authentication bypass vulnerability. An unauthenticated remote attacker can mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl cloud function. The function bypasses its isAuthenticated check when any ...

SQL Injection

Overview llama-index-vector-stores-duckdb is a llama-index vectorstores duckdb integration Affected versions of this package are vulnerable to SQL Injection through the DuckDBVectorStore class. An attacker can manipulate the refdocid parameter, enabling them to read and write arbitrary files on t...

LlamaIndex SQL注入漏洞

LlamaIndex is a data framework for LLM applications from LlamaIndex open source. A SQL injection vulnerability exists in LlamaIndex version v0.12.19, which stems from improper manipulation of the refdocid parameter leading to SQL injection, which could lead to remote code execution...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28408)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the docid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of a us...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2019:1347-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

This update for libvirt fixes the following issues : Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBDS CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling MFBDS...