Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...
CVE-2026-9726
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal Alternativ
2026-07-11 归档
今日共收录 1315 条安全情报，包含 488 个 CVE，410 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes...
CVE-2026-41154
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.
RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side...
CVE-2026-57850
RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a l
Kernel software installed and running inside a Host VM may post improper commands to the GPU...
CVE-2026-45196
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU r
Software installed and run as a non-privileged user may conduct improper GPU system calls to...
CVE-2026-34196
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow a
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross...
CVE-2026-15295
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adm
The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field...
CVE-2026-11321
The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend...
CVE-2026-61461
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers
Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies...
CVE-2026-6212
Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Pri
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in...
CVE-2026-61460
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController,
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP...
CVE-2026-15146
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malici
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows...
CVE-2025-30007
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticat
Excon does not redact additional sensitive/risky headers when following redirects
CVE-2026-54171
### Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitiv
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
CVE-2026-54163
## Summary `secure_headers` builds the `Content-Security-Policy` value by stitching every configured directive together
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
CVE-2026-54071
## Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py ### Summary BabelDOC's vend
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
CVE-2026-54136
### Summary A resource-scoped API token can read script contents outside its allowed path scope via `GET /api/w/{worksp
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
CVE-2026-54063
## Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) ### Summary The `checkSheet()` functio
Deloitte AI Assist for Customer disclosed some configuration information through public-facing...
CVE-2026-57474
Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accept
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
CVE-2026-49977
### Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with dat
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-49866
### Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously be