Savon::Model evaluates WSDL operation names as Ruby source

CVE-2026-53510

### Impact `Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to

历史摘要 · 未重新核验 · GitHub Advisory

Jodit has prototype pollution via Jodit.configure() / ConfigMerge

CVE-2026-54756

### Summary `Jodit.configure(options)` — and the internal `ConfigMerge` / `ConfigProto` helpers — merged user-supplied o

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

CVE-2026-53502

The file_loader performs `unquote()` on the file path AFTER the `abspath() + startswith()` security check. An attacker c

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

CVE-2026-53505

### Summary Thumbor's `filters:proportion()` filter does not enforce an upper bound on `` and runs in the post-transform

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

CVE-2026-53504

### Summary The regular expression used to parse the `convolution` filter exhibits exponential-time backtracking for cer

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

CVE-2026-53503

### Summary Thumbor's `filters:convolution(, , )` filter passes the user-controlled `` value to a C extension (`thumbor/

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

CVE-2026-53501

# HMAC validation bypass via multiple `.replace()` calls when removing URL signature ## Summary Thumbor’s HMAC validat

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

CVE-2026-53500

## Summary The `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images

历史摘要 · 未重新核验 · GitHub Advisory

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

CVE-2026-54737

### Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library re

历史摘要 · 未重新核验 · GitHub Advisory

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Cookie settings

Cookie settings

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Monitor

Mozilla Monitor

历史摘要 · 未重新核验 · Mozilla Security Advisories

The Mozilla Manifesto

The Mozilla Manifesto

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Foundation

Mozilla Foundation

历史摘要 · 未重新核验 · Mozilla Security Advisories

Accessibility Policy

Accessibility Policy

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Create an Account

Create an Account

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Instructions for subscribing to email notifications

Instructions for subscribing to email notifications

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Product Security Home

Product Security Home

历史摘要 · 未重新核验 · Adobe Security Bulletins

Security Bulletins

Security Bulletins

历史摘要 · 未重新核验 · Adobe Security Bulletins

Priority and Severity Ratings

Priority and Severity Ratings

历史摘要 · 未重新核验 · Adobe Security Bulletins