CVE-2026-38819
CVE-2026-38819
Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaus
2026-08-28 归档
今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
CVE-2026-77358
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client
cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
CVE-2026-77341
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
CVE-2026-50152
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
CVE-2025-30156
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
OS Command Injection in PayRange API
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HT
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers with
Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
CVE-2026-81729
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
CVE-2026-81728
Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with
Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
CVE-2026-81838
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 thr
Trilium unauthenticated share-search discloses password-protected and hidden shared notes
CVE-2026-77438
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public shar
Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
CVE-2026-53580
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-downlo
Redis TLS pending-data list use-after-free
CVE-2026-81934
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-d
SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
CVE-2026-10036
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary c
Trilium: Note Import to RCE via Book Note
CVE-2026-53579
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on
Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
CVE-2026-53578
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace ide
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
CVE-2026-81524
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
CVE-2026-81522
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embed
LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint
CVE-2026-65931
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu ent