joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
CVE-2026-49852
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar
2026-07-18 归档
今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。
← 返回归档列表Pimcore: CustomReports Share Bypass
CVE-2026-45704
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses i
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
CVE-2026-45260
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV ass
SQL injection in Amazon Athena Synapse connector
CVE-2026-12283
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard
Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
CVE-2026-45703
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport expor
Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
CVE-2026-45162
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore loc
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
CVE-2026-45309
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on to
RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
CVE-2026-50185
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-
JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-52746
JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis func
Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
CVE-2026-48487
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string a
Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
CVE-2026-48045
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_que
Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
CVE-2026-47183
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exceptio
Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of service
CVE-2026-47180
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_label
SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms
CVE-2026-53712
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security L
Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
CVE-2026-49835
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middle
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50273
Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing librarie
Shopware: Admin Account Takeover via User Recovery Hash Exposure
CVE-2026-48009
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:re
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
CVE-2026-48014
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
CVE-2026-48010
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framewo
Shopware: Stored XSS via SVG file upload — no SVG sanitization
CVE-2026-48015
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelis