sudowp-adminer

SudoWP Adminer（セキュリティフォーク） 貢献者: SudoWP, WP Republic 原作者: Frank Bültge, Inpsyde タグ: adminer, データベース, セキュリティ, cve-2021-21311, ssrf-patch 必要最低バージョン: 5.8 テスト済みバージョン: 6.7 安定版タグ: 1.5.0 ライセンス: GPLv2 またはそれ以降 セキュリティ通知 CVE-2021-21311 これは、WordPressプラグイン「Adminer」のセキュリティ強化版フォーク です。 脅威:...

CVE-2026-101883

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

EUVD-2026-90256

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883: Server-Side Request Forgery (SSRF)

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-86158

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2022-29063

CVE-2022-29063: Apache OfBiz における RMI 接続を介した Java デシリアライゼーション OfBiz Solr プラグインはデフォルトで、localhost のポート 1099 に対して自動的に RMI リクエストを行うように設定されています。攻撃者は、localhost 上で悪意のある RMI サーバーをホストすることで、サーバー起動時または再起動時にこの動作を悪用し、OfBiz を起動したユーザーとして任意のコードを実行し、権限を昇格させる可能性があります。 ベンダー開示: この脆弱性に関するベンダーの開示と修正は、こちら でご確認いただけます。...

Linux Distros Unpatched Vulnerability : CVE-2026-100693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to...

CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

CVE-2026-50228 Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

EUVD-2026-85151

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

PT-2026-97206

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.64 Description An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed on localhost TCP port 9993. This occurs because Chromium remote debugging is enabled within the...

PT-2026-97205

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...

CVE-2026-50227: Missing Authentication for Critical Function

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

Malicious code in ragacateslikodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a5a8774b4ce673a050b7e26c7d08aec66320fc14257196157363935ac19aa1 On require/import of the package's main entry, a top-level async IIFE probes http://localhost:5000 for a hardcoded set of paths /admin, /flag, /profi...

MAL-2026-16252 Malicious code in ragacateslikodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a5a8774b4ce673a050b7e26c7d08aec66320fc14257196157363935ac19aa1 On require/import of the package's main entry, a top-level async IIFE probes http://localhost:5000 for a hardcoded set of paths /admin, /flag, /profi...

sonar v0.9.1

██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a group — normally th...