pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without...
CVE-2026-82462
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token vali
2026-08-30 归档
今日共收录 849 条安全情报，包含 76 个 CVE，428 篇安全通告，以及 85 篇研究论文。
← 返回归档列表pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in...
CVE-2026-82465
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.val
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route...
CVE-2026-82466
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without...
CVE-2026-82472
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication,
Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route...
CVE-2026-82469
Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT acces
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp...
CVE-2026-82470
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in...
CVE-2026-82463
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in...
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry...
CVE-2026-82461
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol...
CVE-2026-82457
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t an
The cohttp package before 6.3.0 for OCaml allows directory traversal.
CVE-2026-82481
The cohttp package before 6.3.0 for OCaml allows directory traversal.
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers...
CVE-2026-82477
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal netw
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem...
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in...
CVE-2026-82453
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attacker
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check...
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrep
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP...
CVE-2026-82450
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that al
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders...
CVE-2026-82447
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first throu
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an...
CVE-2026-82364
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file
In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate...
CVE-2026-80725
In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation cri
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability...
CVE-2026-81346
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX