pytonapi has a Webhook Custom Path Authentication Bypass
CVE-2026-54635
pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.
2026-07-29 归档
今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。
← 返回归档列表QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
CVE-2026-54609
QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handle
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
CVE-2026-54603
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0
OAuth: Cross-origin token-request redirects can expose signed request metadata
CVE-2026-54605
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth:
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
CVE-2026-54620
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite agg
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
CVE-2026-54619
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite func
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
CVE-2026-67182
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass acce
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
CVE-2026-54345
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
CVE-2026-67181
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchroni
Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arb
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
CVE-2026-66754
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that all
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
CVE-2026-61609
Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limite
tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
CVE-2026-66752
tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
CVE-2026-54593
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2,
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
CVE-2026-66751
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to ar
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
CVE-2026-45293
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.
Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
CVE-2026-66750
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow
GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
CVE-2026-47427
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
CVE-2026-66749
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash th