Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

core — Vulnerabilities & Security Advisories 148

All 148 CVE vulnerabilities found in core, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerabilities associated with the core product from major vendors, categorized under the Common Weakness Enumeration (CWE) framework for technical accuracy. It serves as a centralized repository for security data related to foundational software components, focusing on systemic issues that impact stability and security across multiple platforms. The content collected on this page encompasses a wide spectrum of vulnerability types, including buffer overflows, injection flaws, and configuration errors, which are frequently exploited to gain unauthorized access or cause denial of service. The data spans the last ten years, providing a comprehensive historical context that allows security professionals to analyze trends, assess the evolution of threat landscapes, and understand how specific weaknesses have been addressed or remain prevalent in modern systems. This temporal range ensures that both legacy issues and recent discoveries are accessible for thorough review. By using this resource, you can effectively track vendor advisories to stay informed about critical patches and mitigation strategies released for the core product. You can also gain a deeper understanding of specific weakness classes by examining their prevalence and impact across different versions and environments. Additionally, the page enables you to look up a product's vulnerability history, helping you evaluate long-term security posture and prioritize remediation efforts based on verified historical data. This functionality supports informed decision-making for security audits, risk assessments, and compliance reporting without the need to navigate multiple fragmented sources.

Vendor: Drupal

CVE ID Title CVSS Severity Published
CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection CWE-863 7.1 High 2026-10-15
CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking CWE-117 8.1 High 2026-10-15
CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views CWE-79 8.0 High 2026-10-15
CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description CWE-79 5.2 Medium 2026-10-15
CVE-2026-58392 OPNsense: Stored XSS in Services: NTP GPS CWE-79 5.4 Medium 2026-10-15
CVE-2026-58395 OPNsense: XPath injection in MVC safe-delete CWE-643 4.3 Medium 2026-10-15
CVE-2026-58393 OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files CWE-22 5.9 Medium 2026-10-15
CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer CWE-22 9.9 Critical 2026-10-15
CVE-2026-58391 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout CWE-79 5.4 Medium 2026-10-15
CVE-2026-53582 OPNsense: XPATH Injection can disclose any secret in config.xml CWE-91 7.1 High 2026-10-15
CVE-2026-108725 Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin CWE-79 5.4 Medium 2026-10-11
CVE-2026-102107 Kiteworks Core user impersonation in a file-request feature CWE-639 4.6 Medium 2026-09-30
CVE-2026-102110 Missing authentication on a Kiteworks appliance setup function CWE-306 5.9 Medium 2026-09-30
CVE-2026-102111 Kiteworks Core Improper Validation of Specified Quantity in Input CWE-1284 4.9 Medium 2026-09-30
CVE-2026-102112 Kiteworks Core Local Privilege Escalation CWE-78 7.8 High 2026-09-30
CVE-2026-102113 Kiteworks Core Local Privilege Escalation CWE-59 7.8 High 2026-09-30
CVE-2026-102114 Kiteworks Core OS Command Injection CWE-78 7.2 High 2026-09-30
CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow CWE-640 9.8 Critical 2026-09-30
CVE-2026-102117 Kiteworks Core Remote Code Execution CWE-807 7.2 High 2026-09-30
CVE-2026-102118 Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation CWE-59 7.8 High 2026-09-30
CVE-2026-102120 Kiteworks Core OS Command Injection CWE-78 8.8 High 2026-09-30
CVE-2026-102122 Kiteworks Core Incorrect Authorization CWE-863 4.3 Medium 2026-09-30
CVE-2026-102123 Kiteworks Core Path Traversal CWE-22 7.4 High 2026-09-30
CVE-2026-102124 Kiteworks Core Missing Authentication for Critical Function CWE-306 6.5 Medium 2026-09-30
CVE-2026-102125 Kiteworks Core Sandbox Escape CWE-653 8.8 High 2026-09-30
CVE-2026-102126 Kiteworks Core Stored Cross-site Scripting (XSS) CWE-79 8.1 High 2026-09-30
CVE-2026-102129 Kiteworks Core Incorrect Privilege Assignment CWE-266 7.2 High 2026-09-30
CVE-2026-102132 Kiteworks Core Privilege Escalation through Improper Access Control CWE-284 7.2 High 2026-09-30
CVE-2026-102133 Kiteworks Core Arbitrary File Write through Command Injection CWE-77 6.6 Medium 2026-09-30
CVE-2026-102134 Kiteworks Core Unprotected Alternate Channel CWE-420 5.4 Medium 2026-09-30

All 148 known CVE vulnerabilities affecting core with full Chinese analysis, references, and POCs where available.