IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions...
CVE-2025-64649
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle te
2026-08-29 归档
今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。
← 返回归档列表IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic...
CVE-2025-36271
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could a
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly...
CVE-2025-36290
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate valid
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and...
CVE-2026-80198
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allo
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation...
CVE-2026-73108
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry...
CVE-2026-80193
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new t
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped....
CVE-2026-80346
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
CVE-2026-55855
### Summary A SQL injection is possible when the connector escapes Buffer parameters client-side under a multi-byte cli
RestrictedPython guard hooks can be shadowed via positional-only arguments
CVE-2026-55830
### Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr
Snipe-IT has an Improper Privilege Management issue
CVE-2026-55843
## Impact The `update()` method in `UsersController` passes the `permission` request field unconditionally to `Normaliz
MapFish Print has XXE that allows reading arbitrary files of certain types
CVE-2026-55848
### Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs
silverstripe/versioned has XSS in archive admin restore
CVE-2026-55779
### Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin ### Reporter Stev
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
CVE-2026-55873
### Summary SeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables management API. Authorization
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply
CVE-2026-55764
## Summary On the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does `meta.Circulation += am
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any...
CVE-2026-82289
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab.,
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail...
CVE-2026-82306
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfi
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image...
CVE-2026-82343
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing...
CVE-2026-82291
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cros
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE...
CVE-2026-82290
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attac
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to...
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions b