60 matches found
CVE-2026-88420
A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...
kics v2.2.0
!checkmarxhttps://img.shields.io/endpoint?url=https://pgp36n22ol.execute-api.eu-west-1.amazonaws.com/dev/cxflowcache-results%3Fstyle=plastic&logoWidth=20&logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAA7EAAAOxAGVKw4bAAADbklEQVRYhc2XTWidRRSGn3MJl1AkZFFcFCkFIYKC...
CVE-2026-38165
A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...
GO-2026-5104 AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
CVE-2026-36728
A markdown based cross-site scripting XSS vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message...
PT-2026-48174
A markdown based cross-site scripting XSS vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message...
PT-2026-36808
Name of the Vulnerable Software and Affected Versions 3onedata modbus gateway device model GW1101-1DRS-485-TB-P hardware version V2.2.0 versions prior to 3.0.59B2024080600R4353 Description Authenticated users can execute arbitrary shell commands with root privileges. This is possible by providing...
OpenAirInterface 安全漏洞
OpenAirInterface is a mobile communication network software platform developed by the French company OpenAirInterface. OpenAirInterface V2.2.0 AMF contains a security vulnerability. This vulnerability stems from an incorrect message sequence, which leads to incorrect state transitions during the ...
CVE-2026-31841: Unparsed Raw Web Content Delivery
Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing statements which were...
CVE-2024-55073
A Broken Object Level Authorization vulnerability in the component /api/users/user-id of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household...
CVE-2025-22983
A security vulnerability exists in iceCMS version 2.2.0 due to an access control issue in the /square/getAllSquare/circle component. This flaw allows unauthenticated attackers to access sensitive information . As a temporary workaround, it is recommended to restrict access to this specific compon...
CVE-2025-22983
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information...
Dcat Admin admin/articles/create interface cross-site scripting vulnerability
Dcat Admin is a second development based on laravel-admin to build the backend system tools . A cross-site scripting vulnerability exists in Dcat Admin v2.2.0-beta, which stems from the lack of effective filtering and escaping of user-supplied data in /admin/articles/create, and can be exploited ...
CVE-2024-42662
An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request...
CVE-2024-40465
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file...
CVE-2024-40464
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file...
CVE-2024-40465
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file...
CVE-2024-31584
Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbufferloader.cpp...
CVE-2024-31584
Pytorch versions before v2.2.0 are vulnerable to an Out-of-bounds Read flaw within the torch/csrc/jit/mobile/flatbuffer_loader.cpp component. The root cause is a missing validation for the mobile_ivalue_size_ variable against the ivalues->size() in the FlatbufferLoader::parseModule function, w...