OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers
CVE-2026-45684
### Summary OBI's log enricher mishandles `writev` buffers by reading only the first `iovec` entry but using the total
2026-05-19 归档
今日共收录 917 条安全情报，包含 132 个 CVE，384 篇安全通告，以及 107 篇研究论文。
← 返回归档列表OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
CVE-2026-45682
### Summary The custom `CappedConcurrentHashMap` introduced for Java TLS state tracking never removes keys from its ins
OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure
CVE-2026-45683
### Summary The Java TLS ioctl probe reads user-controlled ioctl pointers with `bpf_probe_read` instead of `bpf_probe_r
OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
CVE-2026-45681
### Summary The per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload s
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
CVE-2026-45680
### Summary OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy syst
Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability
CVE-2026-35433
## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .N
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
CVE-2026-42899
## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .N
Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability
CVE-2026-32175
## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .N
ws: Uninitialized memory disclosure
CVE-2026-45736
### Impact The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray`
AVideo: Authenticated Arbitrary File Read in view/update.php
CVE-2026-45731
### Summary view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file()
An attacker in a privileged network position may be able to leak sensitive information. A path...
CVE-2026-20685
An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addres
HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user...
CVE-2026-29963
HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /t
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any...
CVE-2026-8843
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to ins
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the...
CVE-2026-32849
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/op
HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police...
CVE-2026-29965
HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to
In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles...
CVE-2025-56352
In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations duri
HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper...
CVE-2026-29962
HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-suppli
Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows...
CVE-2023-24215
Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB...
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an un
Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability...
CVE-2026-41085
Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an auth