sudowp-adminer

SudoWP Adminer（セキュリティフォーク） 貢献者: SudoWP, WP Republic 原作者: Frank Bültge, Inpsyde タグ: adminer, データベース, セキュリティ, cve-2021-21311, ssrf-patch 必要最低バージョン: 5.8 テスト済みバージョン: 6.7 安定版タグ: 1.5.0 ライセンス: GPLv2 またはそれ以降 セキュリティ通知 CVE-2021-21311 これは、WordPressプラグイン「Adminer」のセキュリティ強化版フォーク です。 脅威:...

CVE-2026-101883

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

EUVD-2026-90256

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883: Server-Side Request Forgery (SSRF)

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-86158

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2022-29063

CVE-2022-29063：Apache OfBiz 中通过 RMI 连接进行的 Java 反序列化 OfBiz Solr 插件默认配置为自动向 localhost 的 1099 端口发起 RMI 请求。 通过在 localhost 上托管恶意 RMI 服务器，攻击者可以在服务器启动或重启时利用此行为，以启动 OfBiz 的用户身份运行任意代码，并可能提升其权限。 厂商披露： 该漏洞的厂商披露和修复可在此处找到。 要求： 此漏洞需要： 在 localhost:1099 上运行恶意 RMI 服务器 等待 Apache OfBiz 应用程序启动/重启 概念验证： 更多详情和利用过程可参阅此...

Linux Distros Unpatched Vulnerability : CVE-2026-100693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to...

CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

CVE-2026-50228 Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

EUVD-2026-85151

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

PT-2026-97206

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.64 Description An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed on localhost TCP port 9993. This occurs because Chromium remote debugging is enabled within the...

PT-2026-97205

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...

CVE-2026-50227: Missing Authentication for Critical Function

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

Malicious code in ragacateslikodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a5a8774b4ce673a050b7e26c7d08aec66320fc14257196157363935ac19aa1 On require/import of the package's main entry, a top-level async IIFE probes http://localhost:5000 for a hardcoded set of paths /admin, /flag, /profi...

MAL-2026-16252 Malicious code in ragacateslikodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a5a8774b4ce673a050b7e26c7d08aec66320fc14257196157363935ac19aa1 On require/import of the package's main entry, a top-level async IIFE probes http://localhost:5000 for a hardcoded set of paths /admin, /flag, /profi...

sonar v0.9.1

██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a group — normally th...