Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user...
CVE-2026-38428
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a G
2026-05-06 归档
今日共收录 1285 条安全情报，包含 277 个 CVE，391 篇安全通告，以及 322 篇研究论文。
← 返回归档列表A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function...
CVE-2026-7855
A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /
Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The...
CVE-2024-52911
Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user...
CVE-2026-42997
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request aut
Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass
CVE-2026-42610
## Summary Information disclosure exists in `Grav CMS v1.8.0-beta.29`. Despite previous security patches (notably in `v1
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
CVE-2026-42841
### Summary An authenticated user with page editing permissions can inject an executable JavaScript event-handler attri
Grav API Privilege Escalation to Super Admin
CVE-2026-42843
### Summary An insecure direct object reference and logic flaw in the Grav API plugin (`UsersController::update`) allow
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
CVE-2026-42315
### Summary No sanitization of package folder name allows writing files anywhere outside the intended download directory
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
CVE-2026-44167
### Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc) ### Patch
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
CVE-2026-43891
### Details The vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The
PyLoad Vulnerable to Path Traversal via Package Folder Name
CVE-2026-42314
Insufficient sanitization of package folder names allows writing files outside the intended download directory. ## Affe
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
CVE-2026-42304
### Details The twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during D
GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
CVE-2026-42285
### Summary Remote Denial of Service (DoS) via Nil Pointer Dereference in BGP Update Processing An unauthenticated remot
Kimai vulnerable to formula Injection via tag names in XLSX export
CVE-2026-42267
## Summary Any `ROLE_USER` can create a tag with a formula string as its name (e.g. `=SUM(54+51)`) via `POST /api/tags`
JupyterHub has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
CVE-2026-42266
The allow-list of extensions that can be installed from PyPI Extension Manager (`allowed_extensions_uris`) is not correc
parse-server: MFA SMS one-time password accepted twice under concurrent login
CVE-2026-43930
### Impact A race condition in the MFA SMS one-time password (OTP) login path allows two concurrent `/login` requests c
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
CVE-2026-43929
### Summary `ssrfcheck` v1.3.0 (latest) fails to block Server-Side Request Forgery attacks when the target private IP a
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
CVE-2025-8267
# SSRF Bypass in `ssrfcheck` - fails to classify reserved IP address space as invalid `ssrfcheck` is an npm package tha
wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured
CVE-2026-43901
## Description ### Impact `wireshark-mcp` exposes a `wireshark_export_objects` MCP tool that accepts an attacker-contr
link-preview-js vulnerable to IPv6 and internal loopback attacks
CVE-2026-43897
### Impact The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be r