Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
CVE-2026-45074
`Cas2Handler` builds this `service` parameter from `Request::getSchemeAndHttpHost()`, which reflects the attacker-contro
2026-05-28 归档
今日共收录 1581 条安全情报，包含 810 个 CVE，383 篇安全通告，以及 109 篇研究论文。
← 返回归档列表Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
CVE-2026-45073
### Description `Symfony\Component\Cache\Adapter\PdoAdapter` is the PDO-backed cache adapter. Its `clear($prefix)` meth
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
CVE-2026-45072
### Description Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Tw
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
CVE-2026-45070
### Description `Symfony\Component\Mime\Header\ParameterizedHeader` (and the related parameter handling reachable from
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
CVE-2026-45068
### Description Symfony Mailer selects a transport via the `MAILER_DSN` environment variable / configuration (e.g. `smt
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
CVE-2026-45067
### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
CVE-2026-44982
## Summary The CrowdSec AppSec component fails to read the HTTP request body for any request whose `Content-Length` is
Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
CVE-2026-44726
## Summary A flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in pl
A vulnerability was detected in TeamSpeak 3 Server up to 3.13.7. This issue affects some unknown...
CVE-2026-4392
A vulnerability was detected in TeamSpeak 3 Server up to 3.13.7. This issue affects some unknown processing of the compo
A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7. This vulnerability...
CVE-2026-4391
A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7. This vulnerability affects unknown code o
A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function...
CVE-2026-4390
A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function process_resend_queue of the
Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.
CVE-2025-67903
Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.
Command injection in Raynet rvia 12.6.4392.49-amd64.deb allows adversaries to execute commands...
CVE-2025-69600
Command injection in Raynet rvia 12.6.4392.49-amd64.deb allows adversaries to execute commands via getconfig, and upload
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive...
CVE-2026-38808
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the Prod
Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly...
CVE-2026-49054
Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Configured Access Cont
Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate...
CVE-2026-38807
Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserContr
A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of...
CVE-2026-38931
A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp
Command injection in Raynet rvia version 12.6.4392.49-amd64.deb allows adversaries to execute...
CVE-2026-38945
Command injection in Raynet rvia version 12.6.4392.49-amd64.deb allows adversaries to execute arbitrary Java code via a
A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown...
CVE-2025-70116
A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can r
OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template...
CVE-2026-38930
OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component