Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...
CVE-2026-6095
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime all
2026-05-20 归档
今日共收录 1110 条安全情报，包含 284 个 CVE，411 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...
CVE-2026-8493
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox In
Improper input validation in the System Management Mode (SMM) communications buffer could allow a...
CVE-2024-36343
Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to
Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on...
CVE-2026-8370
Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is...
CVE-2026-8073
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file del
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers...
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0
JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had...
CVE-2026-27173
JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kube
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is...
CVE-2026-8096
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypa
An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an...
CVE-2026-39250
An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly acces
LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command...
CVE-2026-41470
LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows at
@angular/platform-server: SSRF via Hostname Hijacking
CVE-2026-46417
### Impact A Server-Side Request Forgery (SSRF) vulnerability exists in `@angular/platform-server`. The issue stems fro
SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser
CVE-2026-46374
### Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a ma
SQLFluff: Recursive Stack Overflow in Parser
CVE-2026-46373
### Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a ma
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
CVE-2026-45783
### Summary An unauthenticated remote peer can exhaust the disk storage of any `@libp2p/kad-dht` node running in server
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
CVE-2026-45805
### Summary The MCP module's `ReplServer` binds to all interfaces (`0.0.0.0:4403`) and exposes a `/execute` endpoint th
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
CVE-2026-45802
### Impact This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-s
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
CVE-2026-45799
# CVE-2026-45799 ## Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before ski
HAX CMS: Denial of Service using Malicious Import Request
CVE-2026-46357
### Summary The HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creati
OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle
CVE-2026-45785
### Summary The BST name-lookup loop in `DirectoryTree.TryGetDirectoryEntry` (`OpenMcdf/DirectoryTree.cs:35-46`) walks d
rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
CVE-2026-45784
`CipherCtxRef::cipher_update_inplace` incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers