A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150...
CVE-2026-52232
A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build
2026-08-01 归档
今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。
← 返回归档列表ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node...
CVE-2026-68771
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthentic
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
CVE-2026-54785
### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without c
core-geonetwork has an Open Redirect Bypass
CVE-2026-53573
### Summary GeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled extern
sigstore-go fails to check signature timestamps against a signing key's validity period
CVE-2026-54787
sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53609
## Summary `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated e
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
CVE-2026-53606
## Summary sanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `nau
sentence-transformers contains a security control bypass vulnerability that allows attackers to...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code e
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
CVE-2026-52887
## Summary `GET /api/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMs
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
CVE-2026-65841
A `` element placed directly inside an `` (or MathML) container was not removed by Jodit's clean-html sanitizer. The de
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
CVE-2026-58263
### Summary jodit's built-in `clean-html` sanitizer can be bypassed by a MathML/`` carrier that hides a dangerous elemen
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
CVE-2026-62324
### Summary jodit's `sanitizeHTMLElement` neutralizes a `javascript:` `href` using a bare `href.trim().indexOf('javascr
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on...
CVE-2026-34490
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attac
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows...
CVE-2026-59231
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive...
CVE-2026-56570
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Va
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform...
CVE-2026-67822
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The fu
The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON /...
CVE-2026-17346
The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatin
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI...
CVE-2026-17351
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_qu
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0,...
CVE-2026-17349
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a...
CVE-2026-17566
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query in