20099 matches found
Calibre 代码注入漏洞
Calibre is an open-source, free tool developed by Kovid Goyal, a personal developer from India. It serves as a comprehensive e-book reading management and format conversion tool. Versions of Calibre 9.1.0 and earlier had a code injection vulnerability. This vulnerability stemmed from path travers...
SourceCodester Gas Agency Management System 访问控制错误漏洞
The SourceCodester Gas Agency Management System is an open-source gas agency management system developed by SourceCodester. Version 1.0 of the SourceCodester Gas Agency Management System contains a vulnerability related to access control. This vulnerability arises from improper handling of the fi...
Malicious code in ethers-lint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 315365a10d9e3322792c18bdb8c5a8e620bbcc2a9ad8d5a1d5ef139ef6e47777 The package ethers-lint was found to contain malicious code. Source: ossf-package-analysis...
CVE-2026-25049
n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue h...
All gas, no brakes: Time to come to AI church
Welcome to this week's edition of the Threat Source newsletter. Brothers and sisters, gather close for a moment. We are all security followers here gathered in fellowship and community, with one joyful spirit to fight the good fight and do good out there in the security world. It is with that...
UBUNTU-CVE-2025-58190
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
CVE-2026-25757
creationtimestamp| type| source ---|---|--- 2026-02-05 13:46:30+00:00| published-proof-of-concept| https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9 2026-03-06 20:09:04+00:00| seen|...
CVE-2026-1642
creationtimestamp| type| source ---|---|--- 2026-02-05 02:48:12+00:00| seen| https://seclists.org/oss-sec/2026/q1/144 2026-02-05 14:55:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3me4nhuumkx2q 2026-02-06 01:50:05+00:00| seen|...
Moodle 安全漏洞
Moodle is an open-source e-learning software platform developed by Moodle. It is also known as a course management system, learning management system, or virtual learning environment. Versions of Moodle 5.0 and earlier contained security vulnerabilities. These vulnerabilities were caused by...
Microweber 安全漏洞
Microweber is an open-source online store management system that provides drag-and-drop functionality. This system includes modules for adding products and images. Version 2.0.19 of Microweber has a security vulnerability. This vulnerability stems from the /admin/category/create endpoint, which...
EUVD-2026-5418
n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. This issue has been...
EUVD-2026-5419
n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. This can be exploited to obtain critical...
CVE-2026-25049 n8n Has an Expression Escape Vulnerability Leading to RCE
n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue h...
ALPINE-CVE-2026-1642
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...
CVE-2026-1642
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...
EUVD-2026-5498
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...
CVE-2026-1642
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...
CVE-2026-1642
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...
MAL-2026-717 Malicious code in partnerss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c370b0dbfdf4006f77ab698296da5eef2bb1a5ca43e91b932711518a3a0b8c5c The package partnerss was found to contain malicious code. Source: ossf-package-analysis...
Langroid 代码注入漏洞
Langroid is an open-source tool developed using multi-agent programming for LLM tasks. Versions of Langroid prior to 0.59.32 had a code injection vulnerability. This vulnerability stemmed from a bypass in the TableChatAgent’s invocation of the pandaseval tool, which could allow arbitrary code to ...