Pixeldrain API key shared with unverified thirdparty sites
CVE-2026-54254
### Summary When processing Pixeldrain URLs, `cyberdrop-dl-patched` could send an `Authorization` header that includes
2026-07-16 归档
今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表safeurl is Missing IPv6 CIDR Ranges in Blocklist
CVE-2026-54452
The `privateNetworks` blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR r
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to...
CVE-2026-38753
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Serv
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14...
CVE-2026-55399
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with vali
Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause...
CVE-2026-51380
Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of S
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows...
CVE-2026-40952
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients...
CVE-2026-40953
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page...
CVE-2026-40957
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers
The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to...
CVE-2026-12997
The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them...
CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might...
CVE-2026-15895
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent
MantisBT: Stored XSS in print_all_bug_page_word.php
CVE-2026-62944
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML int
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
CVE-2026-52883
Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. Th
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
CVE-2026-52882
### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions. ### Pa
MantisBT: Reflected XSS in admin/install.php via unescaped printf
CVE-2026-52881
MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameter
Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\...
CVE-2026-14960
Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interf
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution...
CVE-2026-58659
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_st
Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly...
CVE-2026-14961
Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sen
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/...
CVE-2026-59258
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that all
Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure...
CVE-2026-56087
Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with ph