SvelteKit before 2.69.1 Prototype Pollution via File Input
CVE-2026-82257
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fi
2026-08-29 归档
今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。
← 返回归档列表SvelteKit before 2.69.1 Denial of Service via Remote Form
CVE-2026-82256
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the N
gitoxide before 0.69.0 Denial of Service via gix-pack
CVE-2026-82254
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-cont
gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
CVE-2026-82253
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule n
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
CVE-2026-82252
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-
gitoxide before 0.52.1 Path Traversal via Submodule Name
CVE-2026-82251
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when de
gitoxide gix-packetline before 0.21.5 Denial of Service
CVE-2026-82250
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs w
gitoxide before 0.38.2 Credential Helper Protocol Field Injection
CVE-2026-82249
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attacker
gitoxide before 0.33.0 Path Traversal via symlink following
CVE-2026-82248
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s
Budibase before 3.41.3 Missing Authorization License Management
CVE-2026-82245
Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authentic
Budibase before 3.41.3 Remote Code Execution via Plugin eval()
CVE-2026-82244
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticat
Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
CVE-2026-82242
Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpo
Budibase backend-core SSRF via incomplete default blacklist
CVE-2026-82241
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.
Budibase before 3.41.3 Privilege Escalation via User Update API
CVE-2026-82240
Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoi
Budibase before 3.41.3 Authorization Bypass via datasources/query
CVE-2026-82239
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowin
SiYuan before v3.8.1 Path Traversal via asset.upload
CVE-2026-82233
SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolut
ptp: vmclock: prevent read-only mappings from becoming writable
CVE-2026-80724
In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becom
of: reserved_mem: prevent OOB when too many dynamic regions are defined
CVE-2026-80723
In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic
wifi: mac80211: validate individual TWT params before driver setup
CVE-2026-80722
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params befo
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
CVE-2026-80721
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references