pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest
CVE-2026-82465
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.val
2026-08-30 归档
今日共收录 849 条安全情报，包含 76 个 CVE，428 篇安全通告，以及 85 篇研究论文。
← 返回归档列表pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check
CVE-2026-82463
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the
pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
CVE-2026-82462
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token vali
pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
CVE-2026-82461
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak
CVE-2026-82481
CVE-2026-82481
The cohttp package before 6.3.0 for OCaml allows directory traversal.
CVE-2026-82477
CVE-2026-82477
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal netw
su-exec through 0.3 Privilege Escalation via Numeric User ID
CVE-2026-82457
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t an
argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
CVE-2026-82456
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller c
RubyGems before 4.0.13 Path Traversal via Symlink Resolution
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi
Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrep
Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock
CVE-2026-82447
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first throu
macrozheng mall Order Submission submit race condition
CVE-2026-82364
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file
net: gro: properly validate BIG TCP aggregation criteria
CVE-2026-80725
In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation cri
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-72984
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66323
Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attac
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator acc...
CVE-2026-56100
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows a
Compatibility Test Suite (CTS)
本次输入为 Android Security Bulletin 中关于 Compatibility Test Suite (CTS) 的条目。CTS 是 Android 平台用于验证设备与系统兼容性的测试套件，通常用于确保不同厂商的设备在行
Compatibility Definition Document (CDD)
本次公告来自 Android Security Bulletin，涉及命名为《Compatibility Definition Document (CDD)》的文档。该文档是 Android 平台的核心规范之一，由 Google 维护，旨在
Tools, build, and related reference
本次输入为 Android Security Bulletin 下的一个参考页面，标题为“Tools, build, and related reference”，指向 Android 官方文档中的构建与工具相关章节（https://sou
Latest Compatibility Definition Document (CDD)
本公告来自 Android Security Bulletin，标题为“Latest Compatibility Definition Document (CDD)”，发布于 2026-08-30。该文档是 Android 生态系统的兼容性