Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

CVE-2026-71322

## Summary The `CertificateExport` handler in `lemur/certificates/views.py` nests its entire ownership / `CertificateP

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

CVE-2026-71307

### Summary Lemur's destination read endpoints -- `GET /api/1/destinations` and `GET /api/1/destinations/` -- return the

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

CVE-2026-71303

### Summary The fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIREC

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

CVE-2026-70667

## Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (`_validate_revocation_url()` in `lemur /certificates/verif

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

CVE-2026-70666

### Summary The ACME client (used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs) connec

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection

CVE-2026-55593

## Summary The Froxlor AJAX endpoint (`lib/ajax.php`) is missing Cross-Site Request Forgery (CSRF) protection. While th

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

CVE-2026-54543

Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into gene

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

CVE-2026-54348

### Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to

历史摘要 · 未重新核验 · GitHub Advisory

devpi-server may leak database contents

CVE-2026-54723

### Impact If the replication protocol is enabled by using the ``primary`` (or deprecated ``master``) role for a server

历史摘要 · 未重新核验 · GitHub Advisory

MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

CVE-2026-55224

## Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall ### Summary The app-store plugin service conca

历史摘要 · 未重新核验 · GitHub Advisory

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

CVE-2026-53423

### Summary `membrane_mp4_plugin` interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, wit

历史摘要 · 未重新核验 · GitHub Advisory

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Cookie settings

Cookie settings

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Monitor

Mozilla Monitor

历史摘要 · 未重新核验 · Mozilla Security Advisories

The Mozilla Manifesto

The Mozilla Manifesto

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Foundation

Mozilla Foundation

历史摘要 · 未重新核验 · Mozilla Security Advisories

Accessibility Policy

Accessibility Policy

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Create an Account

Create an Account

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Instructions for subscribing to email notifications

Instructions for subscribing to email notifications

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Product Security Home

Product Security Home

历史摘要 · 未重新核验 · Adobe Security Bulletins