This issue was addressed with improved checks to prevent unauthorized actions. This issue is...
CVE-2025-24284
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4
2026-06-12 归档
今日共收录 1106 条安全情报，包含 305 个 CVE，402 篇安全通告，以及 120 篇研究论文。
← 返回归档列表MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
CVE-2026-48109
### Impact A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes `Lz4Bloc
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
CVE-2025-27511
## Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Executio
Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds
CVE-2026-48110
# SSH message fields were decoded through allocation-first parsers before field-specific bounds ### Summary Several `r
AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance
CVE-2026-11401
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. An issue in Aurora P
Russh: Unchecked keyboard-interactive prompt count in client auth path
CVE-2026-48107
### Summary In the `russh` client keyboard-interactive authentication path, a malicious SSH server could send a `USERAUT
WsgiDAV encoded dot segments can escape filesystem share roots
CVE-2026-48099
### Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the co
DevGuard has improper authorization on public assets
CVE-2026-48089
### Impact On a DevGuard API instance with one or more **public assets**, any authenticated user — including users from
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
CVE-2026-48059
### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client se
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be...
CVE-2024-45636
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileg
IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request...
CVE-2026-3341
IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allo
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user...
CVE-2026-3329
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype N
IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper...
CVE-2026-4096
IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by th
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute...
CVE-2026-48546
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by expl
IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify...
CVE-2026-7787
IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypass
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by...
CVE-2026-11945
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON docume
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended...
CVE-2026-11986
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabi
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified...
CVE-2026-7870
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malici
@hapi/inert has a static-file confinement bypass via sibling-prefix path
CVE-2026-48049
### Impact `@hapi/inert` serves static files from a directory configured with `path` (in the `directory` / `file` handle
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging...
CVE-2026-8406
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticate