OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format...
CVE-2026-38719
OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specific
2026-05-19 归档
今日共收录 917 条安全情报，包含 132 个 CVE，384 篇安全通告，以及 107 篇研究论文。
← 返回归档列表An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain...
CVE-2026-36438
An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information
NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within...
CVE-2026-32848
NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem
ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.
CVE-2025-57282
ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
CVE-2026-45678
### Summary The Postgres protocol parser assumes `BIND` message payloads contain a valid NUL-terminated portal name. A
OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
CVE-2026-45679
### Summary OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attack
OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
CVE-2026-45676
### Summary OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A
ImageMagick: Policy Bypass in PSD decoder
CVE-2026-45031
Due to a missing check in the PSD decoder it would be possible to bypass the `list-length` resource policy when decoding
Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3`
CVE-2026-32687
### Summary SQL injection in `Postgrex.Notifications.listen/3`: the `channel` argument is interpolated straight into `L
Docker: Race condition in docker cp allows bind mount redirection to host path
CVE-2026-42306
## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target
Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
CVE-2026-41568
## Summary A race condition during `docker cp` mount setup allows a malicious container to create empty files or direct
ImageMagick: Out-of-Bounds Read of a single byte in meta encoder
CVE-2026-45358
An of by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder.
ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define
CVE-2026-45359
An invalid `connected-components:keep-top` value could result in a heap buffer over-read when performing the connected c
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
CVE-2026-45719
# Security Advisory: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API **Affected Software
Docker: `PUT /containers/{id}/archive` executes container binary on the host
CVE-2026-41567
## Summary When a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
CVE-2026-45718
## Summary The row action trigger endpoint (`POST /api/tables/:sourceId/actions/:actionId/trigger`) fails to validate t
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
CVE-2026-45716
## Summary The `POST /api/global/users/onboard` endpoint is protected by `workspaceBuilderOrAdmin` middleware, allowing
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
CVE-2026-8162
### Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
CVE-2026-8161
### Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
CVE-2026-45701
### Impact The password reset tokenand API key generation uses a weak cryptographical hash algorithm. ### Patches Fix