CVEs

Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection

Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup

Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup

Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates

Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource

Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names

Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data

Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name

Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in

Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication

Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component

Apache Wicket: A listener is invoked on a page instance the request itself created and never configured

Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation

Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke

Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource

beecue FastBee Groovy Script Executor script code injection

Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting

Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow

WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection

WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection

WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection

ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption

ag-ui-protocol ag-ui Transport Decoder input validation

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not…

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials

ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption

WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

ag-ui-protocol ag-ui HTTP Transport e.text resource consumption

Prefab UI Pyodide sandbox escape to host RCE

ag-ui-protocol ag-ui HttpAgent http.ts information disclosure

Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption

WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection

WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection

WAVLINK WN553X1-B ioos sub_416B50 os command injection

WAVLINK WN553X1-B ioos Service sub_416D88 os command injection

jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not

Beta9 host filesystem exposure via volume path traversal

Beta9 container escape via unvalidated sandbox file paths

Beta9 build sandbox escape via chroot-only isolation

WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection

Hangzhou Xiongmai Technology P2PAPI.dll P2P SDK P2PAPI_Connect buffer overflow

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal