Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0...
CVE-2026-67362
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
2026-08-22 归档
今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。
← 返回归档列表Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4...
CVE-2026-67358
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0...
CVE-2026-67360
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20,...
CVE-2026-67359
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauth
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4...
CVE-2026-74252
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection...
CVE-2026-67361
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.2
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
CVE-2026-77415
Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to: - overwri
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
CVE-2026-77414
Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassab
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
CVE-2026-68508
## Summary `hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untruste
JSONata: Arbitrary Code Execution via crafted JSONata expressions
CVE-2026-77413
## Impact Before JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
CVE-2026-77354
### Summary An uncontrolled resource consumption vulnerability in `openapi3filter` lets any unauthenticated client forc
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
CVE-2026-59989
## Summary The Volt template compiler in Phalcon generates the PHP for the `join` filter by string-concatenating the fi
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
CVE-2026-76905
### Summary A nil-pointer dereference in `openapi3filter.ConvertErrors` lets any unauthenticated client crash a server
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
CVE-2026-64679
### Summary Atlantis versions `>= 0.19.8` and `< 0.45.0` did not consistently validate user-controlled `workspace` value
Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
CVE-2026-63421
# Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the d
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
CVE-2026-61824
## Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
CVE-2026-63466
## Vulnerability Details **File**: `src/lib/addons/feature-event-formatter-md.ts` **Line**: 355 (in v8.0.1; `format()`
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex...
CVE-2026-27875
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autoca
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection...
CVE-2026-41451
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substi
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection...
CVE-2026-41450
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_co