Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
CVE-2026-53501
# HMAC validation bypass via multiple `.replace()` calls when removing URL signature ## Summary Thumbor’s HMAC validat
2026-08-01 归档
今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。
← 返回归档列表Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
CVE-2026-53500
## Summary The `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in...
CVE-2026-58048
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages...
CVE-2026-56568
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It inv
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows...
CVE-2026-59232
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding
HTTP Smuggling in cPanel allows potential leak of credentials.
CVE-2026-58047
HTTP Smuggling in cPanel allows potential leak of credentials.
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public...
CVE-2026-56569
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal config
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems...
CVE-2026-21662
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malic
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in...
CVE-2026-34497
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Syste
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory,...
CVE-2026-56571
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the...
CVE-2026-67607
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fres
Improper neutralization of input during web page generation ('cross-site scripting')...
CVE-2026-34495
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls F
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the...
CVE-2026-56567
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of intern
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator...
CVE-2026-17348
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's bef
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to...
CVE-2025-62347
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is...
CVE-2026-16503
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an...
CVE-2026-17347
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a...
CVE-2026-16504
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database passw
The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin...
CVE-2026-17350
The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
CVE-2026-54737
### Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library re