dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
CVE-2026-54729
## Summary is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yiel
2026-08-01 归档
今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。
← 返回归档列表Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
CVE-2026-65834
### Summary `CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` are never v
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
CVE-2026-68501
### Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId` with no ownership
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
CVE-2026-12075
### Summary `nltk.pathsec` provides an SSRF filter that NLTK documents as a security control, blocking loopback, private
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
CVE-2026-12061
### Summary `ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12072
### Summary A path-traversal vulnerability in `NKJPCorpusReader` allows an attacker who can influence the `fileids
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12074
### Summary `FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is r
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
CVE-2026-41695
`src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175` · Unbounded Resource All
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
CVE-2026-54706
### Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serv
OnionShare Receive mode writes uploaded files even when file uploads are disabled
CVE-2026-54707
### Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode `disable_files` setting at the file upload si
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
CVE-2026-52856
### Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
CVE-2026-52857
### Summary Config file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a g
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Cookie settings
Cookie settings
Mozilla Monitor
Mozilla Monitor
The Mozilla Manifesto
The Mozilla Manifesto
Mozilla Foundation
Mozilla Foundation
Accessibility Policy
Accessibility Policy
Create an Account
Create an Account
Instructions for subscribing to email notifications
Instructions for subscribing to email notifications