Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS
CVE-2026-46430
### Summary The SSE event server bound to `0.0.0.0:5553` on Linux/macOS by default because the platform-dependent host
2026-05-21 归档
今日共收录 1079 条安全情报，包含 251 个 CVE，425 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Setup PHP: Command Injection in Repository-Derived PHP Version Resolution
CVE-2026-46420
### Summary A command injection vulnerability was identified in `shivammathur/setup-php` when the action resolves the P
Diffusers: TOCTOU Trust Remote Code Bypass
CVE-2026-45804
## Background This vulnerability is found in the `diffusers` package - the `transformers`-equivalent library for diffus
RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM
CVE-2026-45792
RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatica
@angular/platform-server: SSRF via Hostname Hijacking
CVE-2026-46417
### Impact A Server-Side Request Forgery (SSRF) vulnerability exists in `@angular/platform-server`. The issue stems fro
SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser
CVE-2026-46374
### Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a ma
SQLFluff: Recursive Stack Overflow in Parser
CVE-2026-46373
### Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a ma
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
CVE-2026-45783
### Summary An unauthenticated remote peer can exhaust the disk storage of any `@libp2p/kad-dht` node running in server
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCom...
CVE-2026-45444
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using M
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the pr...
CVE-2026-20223
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthentica
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about...
CVE-2026-8598
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not requi
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerab...
CVE-2025-31973
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outd
Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on othe...
CVE-2026-22314
Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesa
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replie...
CVE-2026-42960
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authori
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a r...
CVE-2026-33278
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables de
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOC...
CVE-2026-7637
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deseria
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might l...
CVE-2026-24214
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer ove
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might...
CVE-2026-24213
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-boun
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code exe...
CVE-2026-24207
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalati...
CVE-2026-24206
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes