Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This...
CVE-2026-8800
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transf
2026-07-09 归档
今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。
← 返回归档列表FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial...
CVE-2026-15172
FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow...
CVE-2026-15163
Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow denial of service
TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service
CVE-2026-15165
TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows...
CVE-2026-59807
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and ex
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit...
CVE-2026-8649
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Report
rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in...
CVE-2026-59803
rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (prot
Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication...
CVE-2026-59804
Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfigurat
Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the...
CVE-2026-59805
Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authen
The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in...
CVE-2026-14361
The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template
A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This...
CVE-2026-15154
A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Ex
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver...
CVE-2026-14891
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job s
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the...
CVE-2026-14373
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host
DSpace: Path Traversal is possible through LDN message generation
CVE-2026-49833
## Overview A path traversal vulnerability is possible via the [COAR Notify / LDN](https://wiki.lyrasis.org/spaces/DSDO
DSpace: ORE resource URI does not validate scheme for non-web resources
CVE-2026-49830
## Overview When ingesting an aggregated ORE resource by URI (using the [OAI-ORE Harvester](https://wiki.lyrasis.org/sp
DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path
CVE-2026-49831
## Overview The [Curation Task](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126845/Curation+Tasks) feature allows
DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN
CVE-2026-49832
## Overview Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for [COAR Notify/LDN messages
Sharp Missing Authorization Check in Quick Creation Command Endpoints
CVE-2026-53634
### Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check.
async-tar PAX extension-header desync enables tar entry/content smuggling
CVE-2026-53600
## Summary `async-tar` v0.6.0 mis-applies a buffered PAX `size` extension to an intermediary extension header (a GNU lo
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests
CVE-2026-50197
### Summary `zalando/skipper`'s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 `Tran