iOS 15.8.5 and iPadOS 15.8.5
iOS 15.8.5 and iPadOS 15.8.5
2026-05-05 归档
今日共收录 918 条安全情报，包含 208 个 CVE，383 篇安全通告，以及 47 篇研究论文。
← 返回归档列表iOS 18.6.2 and iPadOS 18.6.2
iOS 18.6.2 and iPadOS 18.6.2
Android Code Search
Android Code Search
Android Devices
Android Devices
Secure an Android device
Secure an Android device
Android 16 QPR2
Android 16 QPR2
Mobile network security
Mobile network security
MFSA 2026-18Security Vulnerabilities fixed in Focus for iOS 148.2
MFSA 2026-18Security Vulnerabilities fixed in Focus for iOS 148.2
MFSA 2026-12Security Vulnerabilities fixed in Firefox for iOS 147.4
MFSA 2026-12Security Vulnerabilities fixed in Firefox for iOS 147.4
MFSA 2026-09Security Vulnerabilities fixed in Firefox for iOS 147.2.1
MFSA 2026-09Security Vulnerabilities fixed in Firefox for iOS 147.2.1
The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions...
CVE-2026-5722
The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.
The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to,...
CVE-2025-13618
The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. Th
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
CVE-2026-42037
### Summary The `FormDataPart` constructor in `lib/helpers/formDataToStream.js` interpolates `value.type` directly into
Axios: no_proxy bypass via IP alias allows SSRF
CVE-2026-42038
The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 12
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
CVE-2026-42039
### Summary toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
CVE-2026-42034
### Summary For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https trans
Axios: HTTP adapter streamed responses bypass maxContentLength
CVE-2026-42036
### Summary When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength.
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
CVE-2026-42033
## Summary When `Object.prototype` has been polluted by any co-dependency with keys that axios reads without a `hasOwnP
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
CVE-2026-42042
# Vulnerability Disclosure: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Co
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
CVE-2026-42041
# Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy ##