Cilium 信息泄露漏洞

Cilium is an open-source software developed by Cilium contributors. It is used to provide and transparently protect network connections and load balancing between application workloads, such as application containers or processes. Versions of Cilium prior to 1.17.15, 1.18.9, and 1.19.3 have a...

CI4MS 跨站脚本漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Version CI4MS 0.31.4.0 contains a cross-site scripting vulnerability. This vulnerability arises from the backup module’s filename field allowing XSS payloads to be hidden through SQL file tampering, potentially leading to full...

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that can be exploited by an attacker to bypass permission list validation by embedding shell extension tokens in heredoc bodies to execute unapproved commands at runtime...

Cisco Network Services Orchestrator和Cisco Crosswork Network Controller 资源管理错误漏洞

Cisco Network Services Orchestrator NSO and Cisco Crosswork Network Controller are both products of Cisco, a US-based company. Cisco Network Services Orchestrator is a suite of network automation solutions. Cisco Crosswork Network Controller is a network controller. There is a resource management...

Cisco IoT Field Network Director 访问控制错误漏洞

The Cisco IoT Field Network Director is an end-to-end IoT management system developed by Cisco, Inc. This system offers features such as device management, asset tracking, and intelligent metering. There is an access control vulnerability present in the Cisco IoT Field Network Director. This...

OpenTelemetry 安全漏洞

OpenTelemetry is an open-source, vendor-neutral, open-source observability framework developed by OpenTelemetry. Versions of OpenTelemetry 1.15.0-beta.1 and earlier contain security vulnerabilities. These vulnerabilities stem from the AzureVmMetaDataRequestor class, which reads response bodies...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.14 contained security vulnerabilities. These vulnerabilities stemmed from editing bypasses, allowing authenticated gateway clients to receive unedited secrets through alias fiel...

vm2 安全漏洞

vm2 is a high-level virtual machine/sandbox developed by Czech developer Patrik Simek. It runs untrusted code using Node.js built-in modules listed in the allowlist. Version 3.10.4 of vm2 contains security vulnerabilities. Attackers can exploit these vulnerabilities to obtain host process objects...

Assimp 资源管理错误漏洞

Assimp is an open-source library developed by Assimp. It is used for importing and exporting various 3D model formats. Version 6.0.2 of Assimp contains a resource management vulnerability. This vulnerability originates from the ParseVectorDataArray method in FBXParser.cpp, and it could allow a...

CImg 安全漏洞

CImg is a small open-source C++ toolkit for image processing, developed by GREYC. CImg has a security vulnerability that stems from the lack of validation of the nbcolors field in BMP file headers. This vulnerability may lead to excessive memory allocation and cause a system to crash due to...

Sunnet CTMS SQL注入漏洞

Sunnet CTMS is an enterprise training software developed by Sunnet Corporation in China. Sunnet CTMS has a SQL injection vulnerability, which allows a remote attacker to inject arbitrary SQL commands to read, modify, and delete database content...

Lobster_pro 代码问题漏洞

Lobsterpro is a middleware platform developed by the German company Lobster, used for enterprise data integration and process orchestration. Versions of Lobsterpro prior to 4.12.6-GA contained code vulnerabilities. These vulnerabilities stemmed from weaknesses in the XML parser’s functionality,...

FRRouting 缓冲区错误漏洞

FRouting is an open-source network routing software suite developed for Unix-like platforms. Versions of FRRouting prior to 10.5.3 contained a buffer error vulnerability. This vulnerability stemmed from integer overflows in seven OSPF traffic engineering and segment routing TLV parser functions...

Xerte Online Toolkits 路径遍历漏洞

Xerte Online Toolkits is an online learning content creation platform provided by British company Xerte. Versions of Xerte Online Toolkits 3.15 and earlier contained a path traversal vulnerability. This vulnerability stemmed from the elFinder connector in the /editor/elfinder/php/connector.php...

OAuth2 Proxy 安全漏洞

OAuth2 Proxy is a product developed by OAuth2 Proxy organization that can provide a reverse proxy for authentication with Google, Github, or other providers. There were security vulnerabilities in the versions of OAuth2 Proxy from 7.5.0 to 7.15.1. These vulnerabilities stemmed from the possibilit...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the ksmbd module’s handling of the QUERYINFOSecurity composite request. This vulnerability may le...

Copilot API Proxy 安全漏洞

Copilot API Proxy is a reverse proxy service for the GitHub Copilot API developed by Erick Christian. Versions of Copilot API Proxy prior to 0.7.0 contain security vulnerabilities. These vulnerabilities stem from a flaw in the cors function within the file/src/server.ts file of the component’s...

H3C Magic B1 安全漏洞

H3C Magic B1 is a wireless router produced by H3C Corporation in China. The H3C Magic B1 100R004 and earlier versions have security vulnerabilities. These vulnerabilities stem from operations on the parameter “param” within the file/goform/aspForm, which may lead to buffer overflows...

WSO2 Identity Server 安全漏洞

WSO2 Identity Server IS is an identity authentication server developed by the American company WSO2. There is a security vulnerability present in the WSO2 Identity Server authentication endpoint. This vulnerability stems from insufficient validation of user inputs, which may lead to cross-site...

WordPress plugin Payment Gateway for Redsys & WooCommerce Lite 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

Digital Knowledge KnowledgeDeliver 安全漏洞

Digital Knowledge KnowledgeDeliver is an online learning management system developed by Digital Knowledge Company. Versions of Digital Knowledge KnowledgeDeliver prior to February 24, 2026, contained security vulnerabilities. These vulnerabilities stemmed from hard-coded ASP.NET/IIS machineKey...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. There is a security vulnerability in Apache Airflow, wher...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A heap buffer overflow vulnerability exists in the PDFium component of Google Chrome, which can be exploited by an attacker to execute arbitrary code in the sandbox via specially crafted PDF files...

Microsoft HTTP.sys 缓冲区错误漏洞

Microsoft HTTP.SYS is an HTTP application protocol developed by Microsoft Corporation. There is a buffer error vulnerability in Microsoft HTTP.SYS. Attackers can exploit this vulnerability to cause a denial-of-service attack on the system. The following products and versions are affected: Windows...

Chamilo LMS 代码问题漏洞

Chamilo LMS is an open-source online learning and collaboration system developed by Chamilo. This system supports the creation of teaching content, remote training, and online quizzes. Versions of Chamilo LMS prior to 2.0.0-RC.3 contained code vulnerabilities. These vulnerabilities stemmed from...

notification-controller 数据伪造问题漏洞

Notification-Controller is a GitOps notification controller open source in the Flux project. Versions of Notification-Controller prior to 1.8.3 had a data manipulation vulnerability. This vulnerability stemmed from the lack of verification of the email claim for Google OIDC tokens, which could...

ChurchCRM 安全漏洞

ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.1.0 contained security vulnerabilities. These vulnerabilities stemmed from improper encoding of the EName and EDesc parameters in the EditEventAttendees.php file, which could lead to cross-site scripti...

Elastic Kibana Fleet 安全漏洞

Elastic Kibana Fleet is a component developed by the Dutch company Elastic, designed for centralized management and monitoring of Elastic Agents. There is a security vulnerability in Elastic Kibana Fleet, which stems from unnecessary permission executions. This vulnerability may lead to...

RAGFlow 安全漏洞

RAGFlow is an open-source RAG engine based on deep document understanding, developed by InfiniFlow. Versions of RAGFlow prior to 0.24.0 contain security vulnerabilities. These vulnerabilities stem from the Agent’s Text Processing and Message components using the non-sandboxed jinja2.Template for...

YesWiki 安全漏洞

YesWiki is a wiki system built using PHP by the French organization YesWiki. It is used for creating and managing websites in a collaborative manner. Versions of YesWiki prior to 4.6.0 contained security vulnerabilities; these vulnerabilities stemmed from cross-site scripting vulnerabilities in t...

CI4MS 安全漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Versions of CI4MS prior to 0.31.0.0 contained security vulnerabilities. These vulnerabilities stemmed from the failure to immediately terminate active user sessions after accounts were disabled, potentially allowing persistent...

Code-Projects Online Food Ordering System 代码注入漏洞

The Code-Projects Online Food Ordering System is an open-source online ordering system developed by Code-Projects. Version 1.0 of the Code-Projects Online Food Ordering System contains a code injection vulnerability. This vulnerability arises from incorrect handling of the custid parameter in the...

Zephyr 安全漏洞

Zephyr is an open-source, scalable real-time operating system RTOS developed by Zephyr. There is a security vulnerability in Zephyr, which stems from the socket driver’s behavior of copying user-provided payloads into fixed buffers without checking the available space. This could lead to kernel...

Mastodon 安全漏洞

Mastodon is an open-source social networking server based on ActivityPub, developed by Mastodon. There are security vulnerabilities in versions prior to Mastodon 4.5.8, specifically the 4.5.x branch, and versions prior to Mastodon 4.4.15, specifically the 4.4.x branch. These vulnerabilities stem...

WordPress plugin Education Zone 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Craft CMS 安全漏洞

Craft CMS is an open-source content management system developed by Craft CMS. Versions prior to 4.17.8 and 5.9.14 of Craft CMS had security vulnerabilities. These vulnerabilities stemmed from lack of resource-based authorization verification, which could allow unauthorized access to private asset...

Vikunja 安全漏洞

Vikunja is an open-source to-do application developed by Vikunja developers. Versions of Vikunja from 0.18.0 to 2.2.1 had security vulnerabilities. These vulnerabilities stemmed from insufficient validation of user status during certain authentication processes, allowing users who were already...

WordPress plugin JetEngine SQL注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

jsrsasign 安全漏洞

jsrsasign is a signature verification library developed by Kenji Urushima. Versions of jsrsasign prior to 11.1.1 contained security vulnerabilities. These vulnerabilities stemmed from zero-division errors in the parsing and reduction logic of ext/rsa.js and ext/jsbn.js, which could lead to RSA...

SuiteCRM SQL注入漏洞

SuiteCRM is a customer relationship management system developed by the SuiteCRM team. Versions of SuiteCRM prior to 7.15.1 and 8.9.3 contained an SQL injection vulnerability. This vulnerability occurred when creating or editing reports, where the fieldfunction parameter in the POST data was saved...

OpenEMR 安全漏洞

OpenEMR is a set of open-source medical management systems developed by the OpenEMR community. This system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. Versions of OpenEMR prior to 8.0.0.2 contained security...

kube-router 安全漏洞

Kube-router is a Kubernetes networking solution open sourced by CloudNative Labs. Versions of Kube-router prior to 2.8.0 contained security vulnerabilities. These vulnerabilities stemmed from the proxy module not verifying the externalIPs or loadBalancer IPs, which could lead to improper network...

Wowza Media Systems Wowza Streaming Engine 安全漏洞

Wowza Media Systems Wowza Streaming Engine is a powerful, customizable, and scalable media server software developed by Wowza Media Systems. It enables reliable streaming of high-quality video and audio to any device. Version 4.5.0 of Wowza Streaming Engine contains a security vulnerability cause...

AnythingLLM 安全漏洞

AnythingLLM is an all-in-one AI application open-sourced by Mintplex. AnythingLLM suffers from a security vulnerability that stems from a suspended user not being blocked on the browser extension API key path in multi-user mode, which can be exploited by an attacker to cause the suspended user to...

Erlang/OTP 安全漏洞

Erlang/OTP is an open-source library written in JavaScript that handles exceptional situations. This library can catch exceptions caused by the built-in APIs of node.js. Versions 17.0 to 28.4.1, 27.3.4.9, and 26.2.5.18 of Erlang/OTP contain security vulnerabilities. These vulnerabilities stem fro...

ASUS Business System Control Interface 安全漏洞

ASUS Business System Control Interface is a system control interface developed by ASUS, a Chinese technology company. There is a security vulnerability in the ASUS Business System Control Interface. This vulnerability stems from improper permission allocation, which may allow unauthorized local...

Microsoft Windows SMB Server 授权问题漏洞

Microsoft Windows SMB Server is a network file sharing protocol developed by Microsoft Corporation. It allows applications on computers to read and write files, as well as to request services from server programs on a computer network. There is an authorization vulnerability in Microsoft Windows...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is an open-source application developed by GitHub in the United States. It provides a scalable and easy-to-manage platform by allowing users to set their GitHub instances as virtual devices. Vulnerabilities exist in versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and...

Microsoft Azure MCP Server Tools 代码问题漏洞

Microsoft Azure MCP Server Tools is a model context protocol of the American company Microsoft. It supports various tools, languages, and frameworks, enabling the construction and deployment of applications on Azure. There are code-related vulnerabilities in Microsoft Azure MCP Server Tools...

Microsoft Graphics Component 代码问题漏洞

The Microsoft Graphics Component is a graphics driver component developed by Microsoft Corporation. There are code-related vulnerabilities in the Microsoft Graphics Component. Attackers can exploit these vulnerabilities to cause system denial-of-service attacks. The following products and version...