Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to...
CVE-2026-17923
Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restr
2026-07-30 归档
今日共收录 1598 条安全情报，包含 743 个 CVE，444 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a...
CVE-2026-17956
Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute
Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak...
CVE-2026-17954
Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
CVE-2026-54704
OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements wh
OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
CVE-2026-54712
The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of
ZITADEL Users Can Self-Verify Email/Phone via API
CVE-2026-54693
### Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as veri
proot-distro has a Container Isolation Bypass via Crafted Restore Archive
CVE-2026-54727
## Affected Component - **Package:** proot-distro - **Affected command:** `restore` - **Attack surface:** Host-side Ter
`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
CVE-2026-54574
**Repository:** `termux/proot-distro` **Component:** `proot_distro/commands/install.py` → `_extract_plain_tar()`; also
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
CVE-2026-52839
## Summary Easy!Appointments correctly filters provider-scoped appointments in the `appointments/search` response, pro
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
CVE-2026-52840
### Summary `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
CVE-2026-50559
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parame
Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive
CVE-2026-50558
### Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating a
Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type
CVE-2026-49756
### Summary Req's multipart form encoder interpolates the per-part `name`, `filename`, and `content_type` directly into
Req vulnerable to unbounded archive/compression extraction triggered by response content-type
CVE-2026-49755
### Summary Req's default response pipeline auto-decodes archive and compressed bodies based on the server-supplied `co
veraPDF Parser DoS via PostScript Type 1 Font Programs
CVE-2026-54081
## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow
veraPDF Parser DoS via PostScript CMap Streams
CVE-2026-54080
## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
CVE-2026-54082
### Summary veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and `G
veraPDF Validation XXE via Rich Text
CVE-2026-54078
## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta
veraPDF Validation XXE via XFA
CVE-2026-54079
## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
CVE-2026-54666
### Summary `swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{i