CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
CVE-2026-54782
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1,
2026-07-10 归档
今日共收录 1398 条安全情报，包含 466 个 CVE，522 篇安全通告，以及 115 篇研究论文。
← 返回归档列表CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
CVE-2026-54778
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1,
CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
CVE-2026-54776
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1,
Fluentd: Exposure of Sensitive Information via Monitor Agent API
CVE-2026-44025
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on.
Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint
CVE-2026-59806
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to re
PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload
CVE-2026-59802
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_ur
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk
CVE-2026-52200
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax
An Improper Check for Unusual or Exceptional Conditions vulnerability in the advanced...
CVE-2026-33794
An Improper Check for Unusual or Exceptional Conditions vulnerability in the advanced forwarding toolkit (evo-aftmand)
A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a...
CVE-2026-0276
A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that...
CVE-2026-58123
Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attacker
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows...
CVE-2026-58144
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users wi
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding...
CVE-2026-57019
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Net
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding...
CVE-2026-57022
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper N
mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS
CVE-2026-48862
### Summary Mint's HTTP/2 client accepts `PUSH_PROMISE` frames from any server it connects to and inserts every promise
An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c...
CVE-2026-51923
An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attac
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side...
CVE-2026-60120
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
CVE-2026-53637
### Impact A user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
CVE-2026-52774
### Summary YesWiki's Bazar widget handler reflects the `id` `GET` parameter into HTML attributes using `strip_tags()` o