The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site...
CVE-2025-27852
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack
2026-05-14 归档
今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。
← 返回归档列表Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows...
CVE-2026-8466
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbo
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from...
CVE-2026-33380
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's fi
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a...
CVE-2026-28376
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming req
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by...
CVE-2026-28383
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request b
Editors could delete any annotation, even those they do not have read access to. The editor user...
CVE-2026-28374
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read t
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines...
CVE-2026-43970
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticate
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard...
CVE-2026-33377
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have wr
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server...
CVE-2026-28379
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concur
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses...
CVE-2026-33376
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask expl
Any Editor could delete any snapshot, even if they have no access to read or write them.
CVE-2026-28380
Any Editor could delete any snapshot, even if they have no access to read or write them.
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x...
CVE-2026-21821
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal...
CVE-2026-30905
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11
Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session...
CVE-2026-22677
Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session import endpoint that al
A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to...
CVE-2026-0242
A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL c
Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and...
CVE-2026-33583
Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via a
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow...
CVE-2026-30906
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user t
Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access...
CVE-2026-0247
Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attack
Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables...
CVE-2026-33584
Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensit
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated...
CVE-2026-0240
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensi