A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt...
CVE-2026-75118
A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.2
2026-08-30 归档
今日共收录 849 条安全情报，包含 76 个 CVE，428 篇安全通告，以及 85 篇研究论文。
← 返回归档列表org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
CVE-2026-55859
### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A serv
org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context
CVE-2026-55858
### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A serv
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
CVE-2026-55484
### Summary A single unauthenticated HTTP request to a path starting with `?` (e.g. `GET ? HTTP/1.1`) crashes the entire
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
CVE-2026-82476
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata f
Rodauth before 2.47.0 Open Redirect via Return-to Path
CVE-2026-82467
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested
pac4j-core before 6.5.6 Open Redirect via Backslash Logout
CVE-2026-82464
pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-p
Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown
CVE-2026-82460
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoint
Formwork through 2.3.14 Stored XSS via Referer Header
CVE-2026-82451
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification reques...
CVE-2026-16947
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path b
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark u...
CVE-2026-82473
CVE-2026-82473 影响 KubeEdge CloudCore 1.23.1 及之前版本。CloudCore 的 HTTPS 服务器（端口 10002）接收节点任务状态报告时未进行身份验证校验。攻击者无需任何凭据即可通过网络访问该
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to...
CVE-2026-15369
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versio
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection...
CVE-2026-82476
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata f
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass...
CVE-2026-75807
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and i
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password,...
CVE-2026-82467
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested
pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform()...
CVE-2026-82464
pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-p
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions...
CVE-2026-82456
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller c
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where...
CVE-2026-82452
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lac