phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules
CVE-2026-73481
phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / b
2026-08-15 归档
今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。
← 返回归档列表Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
CVE-2026-73037
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter
TypeORM: migration:generate template-literal code injection
CVE-2026-73651
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Ora
OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.
CVE-2026-73645
OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0
js-yaml: Exponential parsing time in the flow collections leads to denial of service
CVE-2026-73643
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponenti
@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
CVE-2026-73565
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request t
SQL Query Validation Bypass in OpenSearch Direct Query
CVE-2026-18428
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenti
Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
CVE-2026-73562
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.
Gitea runner registration-token GET endpoint performs a write under a read-only token scope
CVE-2026-24059
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creat
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
CVE-2026-58508
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
Private Repository Existence Disclosure via go-get Meta Endpoint
CVE-2026-58507
Private Repository Existence Disclosure via go-get Meta Endpoint
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
CVE-2026-58445
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private rep
Public-only repository tokens can update private PR head branches
CVE-2026-58443
Public-only repository tokens can update private PR head branches
Repository migration SSRF via multi-answer DNS allow-list bypass
CVE-2026-58442
Repository migration SSRF via multi-answer DNS allow-list bypass
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
CVE-2026-58441
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `Del...
CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of pr
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
CVE-2026-58439
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot
Repository Visibility Manipulation via Git Push Options
CVE-2026-58437
Repository Visibility Manipulation via Git Push Options