GenieACS 安全漏洞

GenieACS is an open-source high-performance automatic configuration server designed for remote management of devices enabled with TR-069. Version 1.2.13 of GenieACS contains a security vulnerability, which stems from unvalidated access to the NBI API endpoint...

Code-Projects Online Hotel Booking 代码注入漏洞

Code-Projects Online Hotel Booking is an online hotel reservation system developed by Code-Projects as open source. Version 1.0 of Code-Projects Online Hotel Booking contains a code injection vulnerability. This vulnerability arises from incorrect handling of the parameter “roomname” in the file...

Plane 安全漏洞

Plane is an open-source, self-hosted project planning tool developed by Plane OpenSource. Versions of Plane prior to 1.3.0 contained security vulnerabilities. These vulnerabilities stemmed from the use of the user’s email address as a query parameter in the authentication process, which could lea...

Plane 安全漏洞

Plane is an open-source, self-hosted project planning tool developed by Plane OpenSource. Versions of Plane prior to 1.3.0 contained security vulnerabilities. These vulnerabilities stemmed from a lack of workspace or project filtering in the IssueBulkUpdateDateEndpoint, which could lead to...

ChurchCRM SQL注入漏洞

ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.1.0 had a SQL injection vulnerability. This vulnerability stems from the SQL injection in the QueryView.php file, where the searchwhat parameter is vulnerable to attacks due to SQL injection...

Towards Resilient Intrusion Detection in CubeSats: Challenges, TinyML Solutions, and Future Directions

CubeSats have revolutionized access to space by providing affordable and accessible platforms for research and education. However, their reliance on Commercial Off-The-Shelf COTS components and open-source software has introduced significant cybersecurity vulnerabilities. Ensuring the cybersecuri...

PolarLearn 授权问题漏洞

PolarLearn is an online learning platform developed by PolarNL as open source. Versions of PolarLearn prior to 0-PRERELEASE-15 contained an authorization issue vulnerability. This vulnerability stemmed from the creation of valid sessions for accounts that were already disabled, which could lead t...

PT-2026-30986

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG Electronic Program Guide feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg li...

ROS-20260407-73-0041

A vulnerability in the TLS traffic proxying mechanism of NGINX Plus and NGINX OSS web servers is related to the loading of external unreliable data along with reliable data. Exploitation of the vulnerability could allow an attacker acting remotely to inject data in plain text form...

CVE-2026-35180

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customizesettingsnativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with...

EUVD-2026-19408

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py" file could be overwritten. Then, thi...

CVE-2026-34229

Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting XSS vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8...

BIT-GRAFANA-2026-21724 Missing Protected-field Authorization in Provisioning Contact Points API

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission...

crun: crun: Privilege escalation due to incorrect parsing of the `--user` option

A flaw was found in crun, an open-source OCI Container Runtime. A local user can exploit this vulnerability due to incorrect parsing of the --user option when using crun exec. The value 1 is misinterpreted as root privileges User ID 0 and Group ID 0 instead of the intended User ID 1 and Group ID ...

Distribution 安全漏洞

Distribution is an open-source toolset developed by Distribution, used for packaging, transporting, storing, and delivering content. Versions of Distribution prior to 3.1.0 contained security vulnerabilities. These vulnerabilities stemmed from unvalidated domain URLs under the pull cache mode,...

GLPI SQL注入漏洞

GLPI is an open-source IT and asset management software developed by GLPI. This software provides a comprehensive IT resource management interface, allowing you to create databases for managing various IT assets such as computers, monitors, servers, printers, network devices, telephones, and even...

编号撤回

ChurchCRM is an open-source CRM system developed for churches. This CVE number has been withdrawn...

ROS-20260406-73-0001

A vulnerability in the ngxmailsmtp response header handler of NGINX Plus and NGINX Open Source web servers is related to a violation of the initial buffer boundary. Exploitation of the vulnerability could allow an attacker acting remotely to gain read access to the data...

CI4MS 跨站脚本漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Versions of CI4MS prior to 0.31.2.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the failure to properly clean up user-controlled inputs in the system settings – company information section. A...

plunk 注入漏洞

Plunk is an open-source email sending and management platform developed by Plunk. Versions of Plunk prior to 0.8.0 had a vulnerability related to injection attacks. This vulnerability stemmed from the CRLF header injection in the SESService.ts file, which could allow authenticated API users to...