http4k: `DigestAuthProvider.verify` did not bind to request URI
CVE-2026-54148
### Impact An issue in `DigestAuthProvider.verify`: The `uri` parameter in the client's `Authorization: Digest …` resp
2026-08-18 归档
今日共收录 810 条安全情报，包含 28 个 CVE，396 篇安全通告，以及 98 篇研究论文。
← 返回归档列表http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
CVE-2026-54147
### Impact An issue in `DigestAuthProvider.verify`: **Algorithm silently forced to MD5.** The configured `algorithm`
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
CVE-2026-53766
### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
CVE-2026-53752
### Summary docx4j's `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chai
SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server...
CVE-2026-75482
SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths t
JimuReport contains an authentication bypass vulnerability in the report folder template listing...
CVE-2026-75479
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows un
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user...
CVE-2026-75480
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls,
powerlevel10k fails to neutralize control characters in the package.json version field when...
CVE-2026-75483
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt
Evidently UI fails to properly validate the filename parameter in the dataset materialization...
CVE-2026-75111
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthe
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles...
CVE-2026-75481
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service acco
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN...
CVE-2026-75108
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download...
CVE-2026-71518
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unaut
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a...
CVE-2026-75105
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issu
Crawlab fails to verify user ownership or administrative role on the password-change endpoint,...
CVE-2026-75103
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticate
hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the...
CVE-2026-68765
hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 mod
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing...
CVE-2026-75104
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitr
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in...
CVE-2026-75109
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authe
Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to...
CVE-2026-39254
Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup...
CVE-2026-67917
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality.
Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute...
CVE-2026-67967
Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an in