discount 安全漏洞

discount is a Markdown language parsing and conversion tool developed by Orc developers. Versions of discount 3.0.1.2 and earlier contain security vulnerabilities. These vulnerabilities stem from the compile function in the markdown.c file being manipulated in a way that allows uncontrolled...

pay 安全漏洞

Pay is a PHP payment development tool developed by Yansongda’s individual developers, supporting multiple payment channels. Versions of Pay prior to 3.7.20 contained security vulnerabilities. These vulnerabilities stemmed from the verifywechatsign function, which unconditionally skipped signature...

PT-2026-28337

Name of the Vulnerable Software and Affected Versions Vienna Assistant affected versions not specified Description The Vienna Assistant privileged helper utilizes NSXPC for Inter-Process Communication IPC. The implementation of the shouldAcceptNewConnection function, used by the NSXPC framework t...

CVE-2026-32540

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through = 26.7...

CVE-2026-4761

When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. Installations based on Panorama Suite 2025 25.00.004 are vulnerable unless update...

CVE-2026-4761

The CVE-2026-4761 issue affects Windows machines where a certificate and its private key are installed in the certificate store via the Network and Security tool. The underlying problem is that access rights to the private key are unnecessarily granted to the operator group. Affected installation...

SUSE-SU-2026:1011-1 Security update 5.0.7 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - Non-customer-facing optimization and update golang-github-boynux-squidexporter: - Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes jscPED-14971: Added compatibility for Squi...

MAL-2026-2177 Malicious code in linting (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5cb47704e5a0d8d5d241dd382567f85027854c50652bb5889cde58c2b6db00a7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

SUSE CVE-2026-30856

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming...

SUSE CVE-2026-30858

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in the webfetch tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including privat...

Kiteworks Secure Data Forms 跨站脚本漏洞

Kiteworks Secure Data Forms is a data interaction tool provided by the American company Kiteworks. It offers capabilities for secure data collection and form submission management. Versions of Kiteworks Secure Data Forms prior to 9.2.1 had a cross-site scripting vulnerability. This vulnerability...

n8n SQL注入漏洞

n8n is an open-source, scalable workflow automation tool developed by n8n. Versions of n8n prior to 2.14.1, 2.13.3, and 1.123.26 have a SQL injection vulnerability. This vulnerability stems from the Data Table Get node, which may lead to data modification or deletion...

PT-2026-28054

Name of the Vulnerable Software and Affected Versions Bookly versions through 26.7 Description The Bookly bookly-responsive-appointment-booking-tool contains a flaw due to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This issue...

pdf-image 安全漏洞

pdf-image is a Node.js tool developed by Masafumi Oyamada for converting PDFs to PNG images. Versions of pdf-image 2.0.0 and earlier contain security vulnerabilities. These vulnerabilities stem from the fact that the pdfFilePath parameter is not verified, which may lead to OS command injection...

Signify 安全漏洞

Signify is a digital code signing verification and inspection tool developed by Ralph Broenink. Versions of Signify prior to 0.9.2 contained security vulnerabilities. These vulnerabilities were caused by issues with the signeddata.py and context.py components, which could allow remote attackers t...

Thumbler 安全漏洞

Thumbler is a video and image thumbnail extraction tool developed by Mohamed Mahrous Sayed. Versions of Thumbler 1.1.2 and earlier contain security vulnerabilities. These vulnerabilities stem from unvalidated input, output, time, or size parameters in the thumbnail generation function, which may...

textract 安全漏洞

Textract is a text extraction tool developed by David Bashford, which supports multiple formats. Textract versions 2.5.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from unvalidated file path parameters, which could lead to OS command injection attacks...

n8n 安全漏洞

n8n is an open-source, scalable workflow automation tool developed by n8n. Versions of n8n prior to 1.123.22, 2.9.3, and 2.10.1 contained security vulnerabilities. These vulnerabilities stemmed from the JavaScript Task Runner’s ability to allocate uninitialized memory buffers, which could lead to...

The vulnerability of the command-line tool for working with Wheel files is related to incorrect path name restrictions, which allows attackers to escalate their privileges or execute arbitrary code.

The vulnerability of the command-line tool for working with Wheel files is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability can allow an attacker to increase their privileges or execute arbitrary code...

PT-2026-27762

When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. Installations based on Panorama Suite 2025 25.00.004 are vulnerable unless...