Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL...
CVE-2026-8889
Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) an
2026-06-04 归档
今日共收录 1001 条安全情报，包含 200 个 CVE，398 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Local privilege escalation due to DLL hijacking vulnerability. The following products are...
CVE-2026-50033
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock D
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert...
CVE-2026-8874
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules
Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain...
CVE-2026-37700
Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via t
A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS...
CVE-2026-26825
A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reacha
Local privilege escalation due to DLL hijacking vulnerability. The following products are...
CVE-2026-44682
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock D
An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML...
CVE-2026-42839
An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name,
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the...
CVE-2026-7888
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute...
CVE-2026-26378
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file
An issue in Koha v.25.11 and before allows a remote attacker to execute arbitrary code via the...
CVE-2026-26379
An issue in Koha v.25.11 and before allows a remote attacker to execute arbitrary code via the Z39.50 configuration modu
Docling Core: Unsafe remote filename resolution
CVE-2026-44023
### Impact In versions `>= 1.5.0, = 2.74.1` ### Workarounds If upgrading is not immediately possible, avoid passing unt
Docling Core: Insufficient validation of image reference URIs
CVE-2026-44019
### Impact In versions `>= 2.5.0, = 2.74.1` ### Workarounds If upgrading is not immediately possible: - reject `file:`
Docling: Unsafe URI and Path Handling in HTML Backend
CVE-2026-47214
### Impact The HTML backend did not perform sufficient validation during resource handling: - Accepted `file://` URIs en
Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
CVE-2026-44022
### Impact The LaTeX backend's handling of `\includegraphics`, `\input`, and `\include` commands lacked path containment
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
CVE-2026-44020
### Impact The USPTO patent XML parser used the standard `xml.sax.parseString()` without protection against XML External
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
CVE-2026-44018
### Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling
Froxlor: BIND Zone File Injection via TXT Record Content
CVE-2026-41234
## Summary The `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authentica
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
CVE-2026-40898
## Summary An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by s
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
CVE-2026-34993
### Summary Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. ### Impact Most appli
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
CVE-2022-31114
### Impact It’s a “*moderate*” vulnerability… but being an admin panel, take this seriously. It’s difficult… but an att