Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing...
CVE-2026-5091
Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions us
2026-05-22 归档
今日共收录 1105 条安全情报，包含 281 个 CVE，422 篇安全通告，以及 120 篇研究论文。
← 返回归档列表@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
CVE-2026-46681
## Summary The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties wit
containerd user ID handling bypass allows runAsNonRoot evasion
CVE-2026-46680
### Impact A bug was found in containerd where containers launched with a numeric `User` directive that cannot be parsed
Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory
CVE-2026-46671
### Impact A maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
CVE-2026-46640
### Description The `obj.(expr)` dynamic-attribute syntax (added in 3.15.0 as the replacement for the deprecated `attri
Twig: Sandbox property and method bypass via object-destructuring assignment
CVE-2026-46639
### Description The object-destructuring assignment syntax introduced in Twig 3.24.0 generates a call to `CoreExtension
Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend...
CVE-2026-8204
Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to ...
CVE-2026-8417
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_up
Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment...
CVE-2026-8350
Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to pr
Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of...
CVE-2026-8421
Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/singl
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since...
CVE-2026-8205
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does no
LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update...
CVE-2026-47102
LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint c
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to ...
CVE-2026-8140
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/down
Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure...
CVE-2026-8135
Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the Ex
Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth...
CVE-2026-8197
Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template render
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the...
CVE-2026-8134
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTempl
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing...
CVE-2026-6826
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to...
CVE-2026-47101
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role
The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due...
CVE-2026-4843
The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability
Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated...
CVE-2026-46473
Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in r