Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
CVE-2026-82736
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-in
2026-09-02 归档
今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
CVE-2026-82735
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expr
jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
CVE-2026-19032
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI sch
Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
CVE-2026-82734
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-f
Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection
CVE-2026-82731
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who c
Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
CVE-2026-74837
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticat
Route handler return value echoed into AshTypescript error response
CVE-2026-82733
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unaut
Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82732
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values
RPC error handler fails open in AshTypescript, disclosing unredacted errors
CVE-2026-77950
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unaut
Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-77856
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticat
CVE-2026-51974
CVE-2026-51974
An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 throu
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted ou...
CVE-2026-18730
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of the component Sess...
CVE-2026-84287
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the f
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-depende...
CVE-2026-84308
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in ph
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs ...
CVE-2026-78606
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields f...
CVE-2026-84191
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescrip
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster...
CVE-2026-13611
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in ...
CVE-2026-75980
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to S
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator...
CVE-2026-19806
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vul
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory trave...
CVE-2026-67395
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validati