كل ثغرات CVE في الأشهر الستة الماضية، محدَّثة يوميًا.

عرض 5 من 5

• حرجةCVE-2026-85724درجة CVSS 9.623‏/09‏/2026

  Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an

  CWE-155CWE-863
• عاليةCVE-2026-87016درجة CVSS 8.109‏/09‏/2026

  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE s

  CWE-155CWE-287openwebui open_webui
• منخفضةCVE-2026-68939درجة CVSS 2.018‏/08‏/2026

  Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv

  CWE-78CWE-88CWE-155
• متوسطةCVE-2026-73412درجة CVSS 6.312‏/08‏/2026

  Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options E

  CWE-78CWE-155
• متوسطةCVE-2026-49482درجة CVSS 4.312‏/06‏/2026

  ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number par

  CWE-155CWE-943