Alerte

Registru de divulgare

Probleme de securitate descoperite de AI Penetration Tester nostru în cel mai auditat cod din lume, divulgate responsabil către mentenanți.

Critică5

Ridicată17

Moderată50

Scăzută3

75 entries

Proiect	CVE-uri	Vulnerabilitate	Severitate	CVSS	Publicat
Budibase/budibase	GHSA-pmpg-2mxq-6xwr	Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete	Ridicată	7.1	24/07/2026
Admidio/admidio	CVE-2026-53760	Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests	Moderată	5.2	09/07/2026
froxlor/froxlor	GHSA-mr9h-45p9-fg8h	Froxlor: Authenticated customers can read other customers' allowed sender aliases	Moderată	4.3	02/07/2026
Budibase/budibase	CVE-2026-48153	Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata	Ridicată	8.5	22/06/2026
Budibase/budibase	CVE-2026-48150	Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign	Critică	9.0	12/06/2026
frangoteam/FUXA	CVE-2026-47721	FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions	Moderată	6.3	08/06/2026
frangoteam/FUXA	CVE-2026-47720	FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString	Moderată	5.3	08/06/2026
frangoteam/FUXA	CVE-2026-47719	FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading	Ridicată	8.2	08/06/2026
remix-run/react-router	CVE-2026-42342	React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint	Ridicată	7.5	03/06/2026
getkirby/kirby	CVE-2026-44176	Kirby CMS's `pages.access` permission is not checked during rendering of page drafts	Moderată	6.0	26/05/2026
openziti/zrok	CVE-2026-45576	zrok copy writes attacker-controlled WebDAV paths outside the destination root	Ridicată	8.3	19/05/2026
openziti/zrok	CVE-2026-45568	rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths	Critică	9.9	19/05/2026
WeblateOrg/weblate	CVE-2026-45106	Weblate: Stored HTML injection in editor search preview	Moderată	4.6	15/05/2026
pyload/pyload	CVE-2026-45348	pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal	Ridicată	8.7	14/05/2026
lin-snow/Ech0	GHSA-fpw6-hrg5-q5x5	ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI	Ridicată	7.4	07/05/2026
lin-snow/Ech0	GHSA-p64j-f4x9-wq66	Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft	Ridicată	8.0	07/05/2026
lin-snow/Ech0	GHSA-pj6q-4vq4-r8cg	Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count	Moderată	6.5	07/05/2026
lin-snow/Ech0	GHSA-3v85-fqvh-7rxf	Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers	Moderată	4.8	07/05/2026
lin-snow/Ech0	GHSA-rj4g-rqgh-rx9h	Ech0 comment model's Email field returned on public /api/comments endpoints	Moderată	5.3	07/05/2026
gotenberg/gotenberg	CVE-2026-42597	Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme	Moderată	5.9	07/05/2026
gotenberg/gotenberg	CVE-2026-42594	Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine	Ridicată	7.5	07/05/2026
gotenberg/gotenberg	CVE-2026-42593	Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes	Moderată	5.3	07/05/2026
gotenberg/gotenberg	CVE-2026-42592	Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes	Moderată	5.3	07/05/2026
LemmyNet/lemmy	GHSA-qxrw-f6fh-34r7	Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users	Moderată	5.5	06/05/2026
LemmyNet/lemmy	GHSA-95q8-x6r6-672m	Lemmy may expose private community data through community, saved, liked, and modlog API views	Moderată	5.3	06/05/2026

Show

Page 1 of 3

Ce CVE-uri s-ar putea ascunde în proiectul tău?Ce CVE-uri s-ar putea ascunde în proiectul tău?

Folosește tu însuți cel mai bun AI Penetration Tester din lume pentru a-ți scana aplicația și a descoperi toate problemele de securitate

Începe un pentest Contactează-ne