آخرین آسیب‌پذیری‌ها

Zuke: Command-form registry descriptors bypass the MCP launch policy

Stored XSS via crafted URLs in HTML ticket content in Request Tracker

Stored XSS via related ticket subject on RTIR Split and Create Incident forms

WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

Stored XSS via HTML scrubber rule in RTIR

Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()

Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors

Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block

Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction

Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache

pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers

My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents

PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route

Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

SonicJS through 3.0.0 Missing Authorization in Content Write API

LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

SerpBear before 3.1.1 Missing Authentication via POST /api/notify

Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp

xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header

WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation