CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
CVE-2026-63220
### Impact `IncomingRequest::isSecure()` trusted the `X-Forwarded-Proto` and `Front-End-Https` headers from any incoming
2026-08-08 归档
今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。
← 返回归档列表jsii-diff: Command Injection via npm: package argument
CVE-2026-15895
## Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report erro
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
CVE-2026-56818
## Summary `RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is excee
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
CVE-2026-66062
### Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The i
go-git: Malicious reference names may modify files outside the reference storage
CVE-2026-71557
### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the reposito
go-git: Worktree operations may follow symlinks
CVE-2026-71556
## Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended wo
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0...
CVE-2026-66914
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an...
CVE-2026-37171
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one
A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0....
CVE-2026-19207
A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1...
CVE-2026-18497
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for p
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser...
CVE-2026-61477
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline
Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path...
CVE-2026-56794
Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A lo
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass...
CVE-2026-16637
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlis
A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the...
CVE-2026-19206
A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopT
Smarty Security stream restriction bypass through stream: resource
CVE-2026-62996
`smarty/smarty` version `5.8.0` can read local files through PHP stream wrappers even when Smarty Security is enabled an
Smarty: Symlink path traversal out of trusted directories
CVE-2026-62992
When Smarty's Security policy is enabled, secure_dir (and the configured template/trusted directories) restrict which lo
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Cookie settings
Cookie settings
Mozilla Monitor
Mozilla Monitor
The Mozilla Manifesto
The Mozilla Manifesto