Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality
CVE-2026-49835
### Impact An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server. T
2026-07-01 归档
今日共收录 1573 条安全情报，包含 770 个 CVE，406 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
CVE-2026-49478
## Impact Three security vulnerabilities were identified in the OIDC Discovery client: 1. **Blind Server-Side Request
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
CVE-2026-48795
### Summary The fix for [GHSA-f5x2-vj4h-vg4c](https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c)
oban_web missing authorization check on `save-job` event handler
CVE-2026-48592
### Summary `oban_web` 2.12.0 through the current unpatched release exposes a `save-job` LiveView event handler that pe
oban_web: Unbounded range expansion in cron describe causes memory exhaustion
CVE-2026-48593
### Summary `oban_web` 2.12.0 introduced a cron expression parser that expands `-`-separated ranges without validating
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
CVE-2026-49824
### Summary The Fission Function admission webhook (`pkg/webhook/function.go`) validated that `spec.secrets[].namespace
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook
CVE-2026-49823
### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were
Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance
CVE-2026-49822
### Summary A low-privilege developer who could create a `KubernetesWatchTrigger` (KWT) in their own namespace was able
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration
CVE-2026-49821
### Summary Fission's `buildermgr` controller processed `Package` CRDs without verifying that `Package.spec.environment
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
CVE-2026-49473
### Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar auth
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
关于家用路由器DNS被恶意篡改导致异常跳转风险的提示
关于家用路由器DNS被恶意篡改导致异常跳转风险的提示
[原创]探索CVE-2026-31431的热补丁修复方案
CVE-2026-31431
[原创]探索CVE-2026-31431的热补丁修复方案
RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Cookie settings
Cookie settings
Mozilla Monitor
Mozilla Monitor
The Mozilla Manifesto
The Mozilla Manifesto
Mozilla Foundation
Mozilla Foundation
Accessibility Policy
Accessibility Policy