VulnScope — 以套件為主體的 CVE 查詢工具- MEDIUM5.3CVE-2026-49342YARD is a documentation generation tool for the Ruby programming language.
- HIGH7.1CVE-2026-49346libde265 is an open source implementation of the h.265 video codec.
- MEDIUM4.3libde265 is an open source implementation of the h.265 video codec.
- HIGH7.1libde265 is an open source implementation of the h.265 video codec.
- MEDIUM5.6Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions
- MEDIUM6.5A use-after-free vulnerability was found in FFmpeg's RASC video decoder.
- HIGH7.8symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest
- MEDIUM6.1symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses
- MEDIUM6.5OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
- MEDIUM6.8OpenBao: LDAPi ldaputil (wrong escape func)
- HIGH7.5StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
- MEDIUM4.4Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure
- CRITICAL9.6Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
- HIGH7.5Langflow: Unauthenticated DoS through multipart form boundary file upload
- MEDIUM6.1Langflow: Logout button does not clear session
- CRITICAL9.9Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
- MEDIUM5.8Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms
- MEDIUM6.1Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
- MEDIUM6.2Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
- MEDIUM6.8dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
- HIGH7.8@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
- HIGH8.6StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
- HIGH7.5StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
- HIGH7.1A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.
- HIGH7.6A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation.