A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic...
CVE-2026-36908
A stack overflow in the AP4_Array::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to
2026-06-28 归档
今日共收录 725 条安全情报，包含 41 个 CVE，384 篇安全通告，以及 89 篇研究论文。
← 返回归档列表An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of...
CVE-2026-36478
An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsSer
A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before...
CVE-2026-36907
A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers t
A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha...
CVE-2026-50767
A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System
pnpm: Reserved bin name deletes PNPM_HOME during global remove
CVE-2026-55699
Maintainer Action Plan ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start w
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
CVE-2026-55698
## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
CVE-2026-49338
## Summary In gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per
gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists
CVE-2026-49339
## Summary The maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
CVE-2026-49340
## Summary A logic error in `ServeCreateOrUpdatePlaylist` allows **any authenticated Subsonic user** (including non-adm
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
CVE-2026-55697
## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
CVE-2026-55180
## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec
ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image
CVE-2026-53465
An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder.
ImageMagick: Memory Leak in wand option parser when providing invalid arguments
CVE-2026-53464
When providing invalid options to the wand option parser a small memory leak will occur.
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
CVE-2026-54244
### Impact The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and
Statamic Vulnerable to CSV formula injection in form submission exports
CVE-2026-54243
### Impact Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submi
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
CVE-2026-53521
## Summary `PATCH /server/{id}` accepts and persists nonexistent `ddns_profiles` IDs for a member-owned server. If anot
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
CVE-2026-50015
## Summary pnpm's patch application pipeline (`@pnpm/patch-package`) performs no path validation on file paths extracte
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
CVE-2026-50017
## Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
CVE-2026-50016
## Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments.
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
CVE-2026-50014
## Summary pnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or