WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows...

CVE-2021-47959

WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exh

历史摘要 · 未重新核验 · GitHub Advisory

AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

CVE-2026-45619

CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (re

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

CVE-2026-45580

## Summary **Type:** Stored cross-site scripting. The Live plugin's "YouTube-style" view renders the live transmission'

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

CVE-2026-45578

## Summary **Type:** Classic shell-metacharacter injection. The YPTSocket notification branch in `plugin/Live/on_publis

历史摘要 · 未重新核验 · GitHub Advisory

Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

CVE-2026-45575

### Impact An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substi

历史摘要 · 未重新核验 · GitHub Advisory

Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets were generated...

CVE-2026-46474

Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets were generated using Perl's built-in ran

历史摘要 · 未重新核验 · GitHub Advisory

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that...

CVE-2026-8695

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers t

历史摘要 · 未重新核验 · GitHub Advisory

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x...

CVE-2026-35194

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated u

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`

CVE-2026-46383

### Summary Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe us

历史摘要 · 未重新核验 · GitHub Advisory

SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

CVE-2026-46491

## Summary `simplesamlphp-module-casserver` builds file paths for the file-based CAS ticket store by directly concatena

历史摘要 · 未重新核验 · GitHub Advisory

Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

CVE-2026-44692

Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then re

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasourc...

CVE-2026-45717

## Summary Budibase exposes a REST API for datasource management. The route `PUT /api/datasources/:datasourceId` is reg

历史摘要 · 未重新核验 · GitHub Advisory

Weblate: Stored HTML injection in editor search preview

CVE-2026-45106

### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor w

历史摘要 · 未重新核验 · GitHub Advisory

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

CVE-2026-45062

### Summary The `splitPos()` function in [`cgi.go`](https://github.com/php/frankenphp/blob/main/cgi.go) misuses `golang

历史摘要 · 未重新核验 · GitHub Advisory

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads contai...

CVE-2021-47952

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python

历史摘要 · 未重新核验 · NVD

libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. At...

CVE-2020-37239

libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety check

历史摘要 · 未重新核验 · NVD

iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode obje...

CVE-2020-37228

iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass

历史摘要 · 未重新核验 · NVD

关于Microsoft ExchangeServer存在多个...

关于Microsoft ExchangeServer存在多个...

历史摘要 · 未重新核验 · CNCERT

A security vulnerability has been detected in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_discovery_option_parse_plmn_list in the library /lib/sbi/conv.c o...

CVE-2026-8728

CVE-2026-8728 影响 Open5GS 至 2.7.7 版本，具体位于 NRF（网络存储功能）组件的 /lib/sbi/conv.c 文件中的 ogs_sbi_discovery_option_parse_plmn_list 函数

历史摘要 · 未重新核验 · NVD

A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint....

CVE-2026-8725

CVE-2026-8725 是一个影响 CoreWorxLab CAAL 产品（版本 ≤ 1.6.0）的服务端请求伪造（SSRF）漏洞。该漏洞存在于文件 src/caal/webhooks.py 的未知函数中，通过 test-hass 端点

历史摘要 · 未重新核验 · NVD