Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and...
CVE-2026-34649
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an
2026-05-13 归档
今日共收录 822 条安全情报，包含 0 个 CVE，457 篇安全通告，以及 56 篇研究论文。
← 返回归档列表Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An...
CVE-2026-23825
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacke
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant...
CVE-2026-23820
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authentic
A vulnerability in a network management service of AOS-8 Operating System could allow an...
CVE-2026-23826
A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow...
CVE-2026-23821
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remot
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and...
CVE-2026-34648
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
CVE-2026-42074
### Summary The `dangerouslyDisableSandbox` parameter is exposed as part of the BashTool input schema, meaning the LLM (
Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS
CVE-2026-32686
Summary `decimal` doesn't bound the exponent on parsed input, so something like `"1e10000000"` is parsed fine but then e
Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
CVE-2026-45090
## Summary `ParameterAnalysis` in `pkg/scanning/parameterAnalysis.go` runs two sequential worker stages that both write
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option
CVE-2026-45089
## Summary When dalfox is run in REST API server mode, the `output`, `output-all`, and `debug` fields in `model.Options
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`
CVE-2026-45088
## Summary When dalfox is run in REST API server mode, the `custom-payload-file` field in `model.Options` is JSON-tagge
protobuf.js: Code injection in pbjs static output from crafted schema names
CVE-2026-44295
## Summary `pbjs` static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names.
protobuf.js: Code injection through bytes field defaults in generated toObject code
CVE-2026-44293
## Summary protobufjs generated JavaScript for `toObject` conversion could include an unsafe expression derived from a
protobuf.js: Prototype injection in generated message constructors
CVE-2026-44292
## Summary protobufjs generated message constructors copied enumerable properties from a provided properties object wit
protobuf.js: Code generation gadget after prototype pollution
CVE-2026-44291
## Summary protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated en
protobuf.js: Process-wide denial of service through unsafe option paths
CVE-2026-44290
## Summary protobufjs allowed certain schema option paths to traverse through inherited object properties while applyin
protobuf.js: Denial of service through unbounded protobuf recursion
CVE-2026-44289
## Summary protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipp
protobufjs has overlong UTF-8 decoding
CVE-2026-44288
## Summary protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decod
protobuf.js is Vulnerable to OS Command Injection in the CLI
CVE-2026-42290
## Summary `pbts` invoked JSDoc by building a shell command string from input file paths and executing it through `chil
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...