libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read...
CVE-2025-15661
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink()
2026-06-19 归档
今日共收录 997 条安全情报，包含 210 个 CVE，375 篇安全通告，以及 115 篇研究论文。
← 返回归档列表setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation...
CVE-2026-47833
setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A comp
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that...
CVE-2026-25865
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to e
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a...
CVE-2026-48937
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This v
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited...
CVE-2026-12390
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using spe
NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to...
CVE-2026-55392
NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. ...
CVE-2026-9692
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within...
CVE-2026-56021
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`...
CVE-2026-48617
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...
CVE-2026-38718
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a bu
Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated...
CVE-2026-55205
Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oa
Webmin accepts basic authentication without session cookies when an attacker provides the 'User...
CVE-2026-56022
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, a
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...
CVE-2026-54106
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...
CVE-2026-54104
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the...
CVE-2026-55203
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference...
CVE-2026-55204
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site...
CVE-2026-56024
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user...
CVE-2026-56020
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL clie
Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS)...
CVE-2026-11982
Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages A
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate...
CVE-2026-46580
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were auto