phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api...
CVE-2026-46365
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpo
2026-05-16 归档
今日共收录 1030 条安全情报，包含 296 个 CVE，439 篇安全通告，以及 15 篇研究论文。
← 返回归档列表WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows...
CVE-2021-47959
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exh
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
CVE-2026-45619
CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (re
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
CVE-2026-45580
## Summary **Type:** Stored cross-site scripting. The Live plugin's "YouTube-style" view renders the live transmission'
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
CVE-2026-45578
## Summary **Type:** Classic shell-metacharacter injection. The YPTSocket notification branch in `plugin/Live/on_publis
Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client
CVE-2026-45575
### Impact An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substi
Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets were generated...
CVE-2026-46474
Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets were generated using Perl's built-in ran
radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that...
CVE-2026-8695
radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers t
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x...
CVE-2026-35194
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated u
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
CVE-2026-46383
### Summary Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe us
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
CVE-2026-46491
## Summary `simplesamlphp-module-casserver` builds file paths for the file-based CAS ticket store by directly concatena
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
CVE-2026-44692
Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then re
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasourc...
CVE-2026-45717
## Summary Budibase exposes a REST API for datasource management. The route `PUT /api/datasources/:datasourceId` is reg
Weblate: Stored HTML injection in editor search preview
CVE-2026-45106
### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor w
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
CVE-2026-45062
### Summary The `splitPos()` function in [`cgi.go`](https://github.com/php/frankenphp/blob/main/cgi.go) misuses `golang
nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT
CVE-2026-40092
### Impact A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
CVE-2026-22810
### Summary A path traversal vulnerability in the OneNote importer allows overwriting arbitrary files on disk. ### Deta
Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure...
CVE-2025-67437
Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows a
An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of...
CVE-2026-38728
An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStr
Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing...
CVE-2026-39053
Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-co