wgcloud 安全漏洞

wgcloud is a lightweight distributed server monitoring and operation system developed by tianshiyeben as an individual developer. Versions of wgcloud prior to 2.3.7 contain security vulnerabilities. These vulnerabilities stem from defects in the test connection function, which may allow for remot...

The vulnerability of the bio_poll() function in the block/blk-core.c module, which supports the block-level kernel in the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the biopoll function in the block/blk-core.c module, which supports the block-level kernel in the Linux operating system, is related to the pointer dereferencing due to poor synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the __nfs42_ssc_open() function in the fs/nfs/nfs4file.c module, which is part of the NFS client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the nfs42sscopen function in the fs/nfs/nfs4file.c module, which is part of the NFS client support in Linux kernel, involves a memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the ice_reset VF() function in the drivers/net/ethernet/intel/ice/iceVFLib.c file of the Intel Ethernet network adapter driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the icereset VF function in the drivers/net/ethernet/intel/ice/ice VFlib.c file of the Intel Ethernet network adapter driver in the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-26475

Summary The setPassword.json.php endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before...

CVE-2026-30403

There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read any file on the victim's server...

CVE-2026-30402

An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function...

PT-2026-26437

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the retrieve function in include/OutboundEmail/OutboundEmail.php fails to properly neutralize the user controlled $id parameter. It is assumed that the...

The vulnerabilities of the functions mdsc_show(), ceph_unlink(), ceph_open(), and ceph_mdsc_release_request() in the Linux kernel’s distributed file system support for Ceph drivers allow attackers to compromise the integrity of protected information or cause service failures.

The vulnerabilities of the functions mdscshow, cephunlink, cephopen, and cephmdscreleaserequest in the Linux kernel’s distributed file system support for Ceph are related to synchronization errors when using shared resources. Exploiting these vulnerabilities can allow attackers to compromise the...

The vulnerability of the soc_info() function in the drivers/tty/serial/ucc_uart.c file of the console TTY driver in the Linux kernel’s serial port allows a hacker to cause a service failure.

The vulnerability of the socinfo function in the drivers/tty/serial/uccuart.c file of the TTY console driver in the Linux kernel’s serial port module is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the ohci_hcd_ppc_of_probe() function in the driver module drivers/usb/host/ohci-ppc-of.c of the Linux operating system’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the ohcihcdppcofprobe function in the drivers/usb/host/ohci-ppc-of.c file of the Linux device driver for USB chipsets is related to errors during link counters updates. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-26430

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3 Description SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the field function parameter received...

OpenEMR 操作系统命令注入漏洞

OpenEMR is a set of open-source medical management systems developed by the OpenEMR community. This system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. Versions of OpenEMR prior to 8.0.0.2 had a vulnerability...

CVE-2026-32886

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype...

CVE-2026-32886

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype...

CVE-2026-32886 Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype...

CVE-2026-32886 Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype...

CVE-2026-32886

Parse Server (Node.js) is affected by CVE-2026-32886 through a cloud function dispatch crash caused by an attacker-controlled function name traversing the JavaScript prototype chain of a registered cloud function handler, leading to a stack overflow. The root cause is prototype chain traversal du...

CVE-2026-32886 Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype...

CVE-2026-28500

A flaw was found in Open Neural Network Exchange ONNX, an open standard for machine learning interoperability. A security control bypass exists in the onnx.hub.load function due to improper logic in its repository trust verification. An attacker can exploit this by providing a malicious model,...