آخرین آسیب‌پذیری‌ها

SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution

Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account

SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

Reflected XSS via client window id in URL client window mode

Git for Windows: git-credential-wincred Erase Path Heap Overflow

Git for Windows: git-credential-wincred OAuth Store Heap Overflow

Oqtane Framework before 10.3.0 SSRF via File Upload From URL

Oqtane Framework before 10.3.0 Broken Access Control via SettingController

WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results

WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks

WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output

Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping

frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs whe…

Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download

Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery

Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)