CVE-2026-107153

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...

EUVD-2026-100886

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

CVE-2026-107126 WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

CVE-2026-107126

The WP Booking System WordPress plugin (versions before 2.1.0.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize and escape a client-controllable request value before storing it. This stored value is subsequently outputted in an administr...

CVE-2026-107126 WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

CVE-2026-50215

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-107153

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...

CVE-2026-107153

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

EUVD-2026-100814

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-106931

SiteGuard Server Edition versions 2.20 through 8.00 Update4 contain an OS command injection vulnerability within the statistics feature, which is enabled by default. A local attacker with low-privileged account access can exploit this flaw to execute arbitrary commands with root or SYSTEM privile...

CVE-2026-108597

A flaw was found in cohere. An attacker with write permissions to an associated Amazon Simple Storage Service S3 bucket can supply a specially crafted model archive containing directory traversal sequences. When the application extracts the archive without validating member file paths, arbitrary...

漏洞库

公开漏洞知识库与 PoC 管理系统（FastAPI + Vue3 + Element Plus + SQLite）...

SUSE CVE-2026-109741

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

EUVD-2026-100714

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended...

Linux Distros Unpatched Vulnerability : CVE-2026-98410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - watchdog: da9063: fix suspend/resume handling of HWRUNNING watchdog da9063wdtsuspend and da9063wdtresume only check watchdogactive, when the watchdog is left...

SonicWALL Global Management System (GMS) < 9.4 Multiple Vulnerabilities (SNWLID-2024-0007)

The version of SonicWALL Global Management System GMS running on the remote host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity XXE injection, potentially resulting in the...

ROS-20261014-73-0057

The vulnerability of the vcnv40decmsg function in the drivers/gpu/drm/amd/amdgpu/vcnv40.c driver for AMD GPU cores in Linux’s Direct Rendering Infrastructure DRI kernel relates to buffer overflow attacks. Exploiting this vulnerability can allow attackers to access protected information or cause...