In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role...

CVE-2026-76350

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_searc

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold...

CVE-2026-76352

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk...

CVE-2026-76348

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can...

CVE-2026-76345

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head cluster

历史摘要 · 未重新核验 · GitHub Advisory

logto-tunnel serves files outside --experience-path via path traversal

CVE-2026-63188

### Summary `@logto/tunnel` serves custom sign-in experience files from the `--experience-path` directory. When the tun

历史摘要 · 未重新核验 · GitHub Advisory

BuildKit has a possible runtime DoS via unbounded group parsing

CVE-2026-61712

### Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a contai

历史摘要 · 未重新核验 · GitHub Advisory

BuildKit: Custom frontend could bypass Seccomp/AppArmor

CVE-2026-61711

### Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the b

历史摘要 · 未重新核验 · GitHub Advisory

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

CVE-2026-62673

## Summary The default `.htaccess` shipped with Grav (and the reference `webserver-configs/htaccess.txt`) contains secu

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

CVE-2026-55694

### Impact An attacker can completely bypass file-name randomization security and without authorization download confide

历史摘要 · 未重新核验 · GitHub Advisory

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

CVE-2024-45747

### Summary A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to up

历史摘要 · 未重新核验 · GitHub Advisory

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

CVE-2026-53966

### Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that

历史摘要 · 未重新核验 · GitHub Advisory

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

CVE-2026-53965

## Summary The HTTP client transport in `mcp/sdk` reads a Server-Sent-Events (SSE) response stream incrementally and ap

历史摘要 · 未重新核验 · GitHub Advisory

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

CVE-2026-53964

### Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be e

历史摘要 · 未重新核验 · GitHub Advisory

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

CVE-2026-53957

### Summary `export_space` and `import_space` tools in `@contentful/mcp-tools` accept LLM-controlled `host` and `proxy`

历史摘要 · 未重新核验 · GitHub Advisory

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

CVE-2026-53951

# Copier: trust-prefix bypass via path traversal runs tasks unprompted ### Summary In copier `>= 9.5.0, str: if u

历史摘要 · 未重新核验 · GitHub Advisory

Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

CVE-2026-53941

## Summary An unprivileged container can block all other containers from starting on the same host by placing a crafted

历史摘要 · 未重新核验 · GitHub Advisory

moby/go-archive: Crafted tar archive can write outside the extraction directory

CVE-2026-17106

### Summary The tar extraction routines in `moby/go-archive` (`Unpack`, `UnpackLayer`, `Untar`/`UntarUncompressed`, and

历史摘要 · 未重新核验 · GitHub Advisory

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Cookie settings

Cookie settings

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Monitor

Mozilla Monitor

历史摘要 · 未重新核验 · Mozilla Security Advisories