Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
2026-08-15 归档
今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。
← 返回归档列表OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix o
Email Management API Bypasses ManageCredentials Feature Restrictions
CVE-2026-55986
Email Management API Bypasses ManageCredentials Feature Restrictions
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
CVE-2026-55984
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
CVE-2026-54481
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet th...
CVE-2026-24059
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creat
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
CVE-2026-23603
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language at...
CVE-2026-13048
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitra
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GE...
CVE-2026-73671
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in clas
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement...
CVE-2026-73670
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators t
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. ...
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/comple...
CVE-2026-73559
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions Complet
A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_...
CVE-2026-19710
A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unkn
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforce...
CVE-2026-73556
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex paramet
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI ...
CVE-2026-73555
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled c...
CVE-2026-73506
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handsh...
CVE-2026-70464
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which...
CVE-2026-70463
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses co
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when...
CVE-2026-70460
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module roo