Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor...
CVE-2020-37256
Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security config
2026-06-26 归档
今日共收录 1370 条安全情报，包含 648 个 CVE，378 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api...
CVE-2025-71333
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoin
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags...
CVE-2021-47986
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the reposit
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user...
CVE-2025-71328
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their accou
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the...
CVE-2025-71324
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-fil
golang.org/x/crypto/ssh: Invoking pathological RSA/DSA parameters may cause DoS
CVE-2026-39829
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessive
golang.org/x/crypto/ssh: Invoking memory leak when rejecting channels can lead to DoS
CVE-2026-39827
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory gr
golang.org/x/crypto/ssh is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
CVE-2026-39835
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be c
golang.org/x/crypto/ssh vulnerable to invoking bypass of certificate restrictions
CVE-2026-39828
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were
golang.org/x/crypto/ssh: Invoking byte arithmetic causes underflow and panic
CVE-2026-46597
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafte
golang.org/x/crypto/ssh/agent: Invoking pathological inputs can lead to client panic
CVE-2026-46598
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
CVE-2026-55165
Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO wit
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>
CVE-2026-55163
## Summary The `PUT /api/1/roles/` handler in `lemur/roles/views.py` gates only on `RoleMemberPermission(role_id).can(
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
CVE-2026-55162
## Summary When verifying an uploaded certificate, `lemur/certificates/verify.py` extracts the CRL Distribution Point
ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop
CVE-2026-53461
An incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash.
ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
CVE-2026-53460
A missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. ## Credit
ImageMagick: Policy Bypass can read disallowed files via symlink
CVE-2026-49219
An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using
ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
CVE-2026-49218
A missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in othe
ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems
CVE-2026-48994
A missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems.
ImageMagick Vulnerable to Stack Overflow in its MVG Decoder
CVE-2026-48734
A crafted MVG file could result in a stack overflow due to a missing depth or visited-set check.