Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
CVE-2026-46638
### Description The fix for CVE-2024-45411 / GHSA-6j75-5wfj-gh66 added an explicit `$loaded->unwrap()->checkSecurity()`
2026-05-22 归档
今日共收录 1105 条安全情报，包含 281 个 CVE，422 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
CVE-2026-46637
### Description Several filters in the `twig/*` extras packages are registered with `is_safe => ['all']`, which tells T
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
CVE-2026-46634
### Description When the sandbox is enabled selectively via `SourcePolicyInterface` (and not globally), a sandboxed tem
Twig: PHP code injection via `{% use %}` template name
CVE-2026-46633
### Description `Compiler::string()` escapes `"`, `$`, `\`, NUL and TAB when generating PHP double-quoted string litera
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
CVE-2026-46629
### Description `IntlExtension` memoises every `\IntlDateFormatter` and `\NumberFormatter` it creates in instance-level
Twig: The `spaceless` filter implicitly marks its output as safe
CVE-2026-46628
### Description The `spaceless` filter is registered with `is_safe => ['html']`, which means Twig's autoescaper does no
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
CVE-2026-46625
## Summary `js-cookie`'s internal `assign()` helper copies properties with `for...in` + plain assignment. When the sour
Russh: Unchecked CryptoVec allocation and growth handling is reachable
CVE-2026-46673
### Title Unchecked `CryptoVec` allocation and growth handling was reachable from local agent inputs in current `russh`
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
CVE-2026-46609
### Impact Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confi
NocoDB: Stale Auth Cache After API Token Deletion
CVE-2026-46554
### Summary Deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cach
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
CVE-2026-46552
### Summary Shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only th
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
CVE-2026-46551
### Summary The `uploadViaURL` path in the v1/v2 attachment API did not enforce `NC_ATTACHMENT_FIELD_SIZE` against the
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
CVE-2026-46549
### Summary The OAuth token strategy attached `oauth_scope` and `oauth_granted_resources` to the request user, but the
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
CVE-2026-46547
### Summary A reflected XSS vulnerability exists in the Page Leaving Warning page. The `ncRedirectUrl` and `ncBackUrl` q
SpiceDB: Caveat structures with nested lists can result in improper cache reuse
CVE-2026-46668
### Impact Users are impacted if: - They have a caveat structure with a nested list, e.g.: ```zed caveat shape(x l
Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
CVE-2026-46654
### Impact - **Key**: `challenger/src/multi_field_challenger.rs` | `MultiField32Challenger::duplexing` | `transcript_ma
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2026-33000
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' ...
CVE-2026-6960
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration...
CVE-2026-48207
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented Deserializati