A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia...
CVE-2025-46284
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An
2026-05-27 归档
今日共收录 1142 条安全情报，包含 375 个 CVE，381 篇安全通告，以及 103 篇研究论文。
← 返回归档列表A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7,...
CVE-2025-43289
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macO
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS...
CVE-2025-43290
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS...
CVE-2025-43451
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...
CVE-2025-46280
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7,...
CVE-2025-43306
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Ta
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
CVE-2026-44646
## Summary `Context.spawn()` in liquidjs creates a child `Context` for the `{% render %}` tag but does not propagate th
Yamcs has No Rate Limiting on Authentication Endpoint
CVE-2026-44596
### Summary The authentication endpoint `POST /auth/token` in `yamcs-core` lacks any form of rate limiting, account loc
Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints
CVE-2026-44595
### Summary The IAM API endpoints (`listUsers`, `getUser`, `listGroups`, and `getGroup`) in `yamcs-core` do not enforce
CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
CVE-2026-44587
### Summary CarrierWave's content_type_denylist check fails to escape regex metacharacters in string entries, causing th
Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations
CVE-2026-44210
## Summary Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
CVE-2026-44177
### TL;DR This vulnerability affects all Kirby sites on Kirby 5.3.0-5.4.0 and is independent from setup conditions and
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
CVE-2026-44174
### TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
CVE-2026-43947
### Summary An unauthenticated Remote Code Execution vulnerability exists in FUXA when `secureEnabled` is set to `true`
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
CVE-2026-43946
### Summary An authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when t
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
CVE-2026-43945
**Pre-auth** RCE in FUXA via Logic Bypass Summary A Critical vulnerability chain exists in FUXA (v.1.3.0-2706) that al
Yamcs Vulnerable to LDAP Injection in LdapAuthModule
CVE-2026-42568
### Summary An LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filt
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
CVE-2026-42462
### Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
CVE-2026-42089
### Impact `yeoman-environment` versions `>= 2.9.0` and `< 6.0.1` install missing local generator packages from caller-
netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures
CVE-2026-41207
HKDF_expand: returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from fai