An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the...
CVE-2026-51937
An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsAp
2026-07-08 归档
今日共收录 1050 条安全情报，包含 282 个 CVE，378 篇安全通告，以及 103 篇研究论文。
← 返回归档列表Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability...
CVE-2026-37270
Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper passwor
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an...
CVE-2026-14739
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeho
The application contains an out-of-bounds write vulnerability that can be exploited by an...
CVE-2026-42953
The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program
The application contains a stack-based buffer overflow vulnerability that can be exploited by an...
CVE-2026-49033
The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arb
The application contains a use-after-free vulnerability that can be exploited to cause memory...
CVE-2026-42958
The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing s
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org...
CVE-2026-28378
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio
Weblate SSRF: outbound URL guard misses some private ranges
CVE-2026-50127
### Impact Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addre
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
CVE-2026-53508
## Summary From **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `opena
KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping
CVE-2026-53572
### Summary `pkg/scalers/postgresql_scaler.go` builds libpq-style connection strings by concatenating `key=value` pairs
Kite has an authenticated cluster RBAC bypass in /api/v1/overview
CVE-2026-53487
## Summary Authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability...
CVE-2026-58471
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() f
FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2...
CVE-2026-58583
FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege esc
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability...
CVE-2026-58469
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_s
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs...
CVE-2026-59708
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeU
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models...
CVE-2026-59707
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that al
GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in...
CVE-2026-58470
GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range(
GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability...
CVE-2026-58472
GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string
An improper access check allows users to display a list of modules in the frontend.
CVE-2026-48956
An improper access check allows users to display a list of modules in the frontend.
An improper access check allows unauthorized users to access com_privacy datasets.
CVE-2026-48957
An improper access check allows unauthorized users to access com_privacy datasets.