A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler....
CVE-2026-13318
A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-
2026-06-26 归档
今日共收录 1370 条安全情报，包含 648 个 CVE，378 篇安全通告，以及 115 篇研究论文。
← 返回归档列表A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest...
CVE-2026-13322
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Re
Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms...
CVE-2026-6325
Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write pas
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity...
CVE-2026-6329
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and all
vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability
CVE-2026-22879
vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
CVE-2026-44622
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name...
CVE-2026-7532
iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced
TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...
CVE-2026-55962
TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the cl
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the...
CVE-2026-6330
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's i
The WebSocket Application Programming Interface lacks restrictions on the number of...
CVE-2026-50176
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc
HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted...
CVE-2026-6331
HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC ve
When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt...
CVE-2026-6092
When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing E
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the...
CVE-2026-8720
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer...
CVE-2026-10098
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose se
Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the...
CVE-2026-11703
Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for t
picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell...
CVE-2025-71340
picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a...
CVE-2026-12975
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without ena
Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who...
CVE-2026-13281
Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the rend
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions...
CVE-2025-71335
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens aft
Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version...
CVE-2021-47987
Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the of