Casdoor upload-resource API resource.go missing authentication
CVE-2026-84423
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource
2026-09-03 归档
今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表WWBN AVideo Password Recovery Token Expiration Bypass
CVE-2026-84480
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to
WWBN AVideo Authentication Bypass via X-Real-IP Header
CVE-2026-84476
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers
AVideo User_Location Plugin Unauthenticated SQL Injection
CVE-2026-84208
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's region
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/load
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
CVE-2026-84372
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, p
Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
CVE-2026-71981
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitra
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
CVE-2026-84366
Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handle
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
CVE-2026-84364
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody()
Mail: Email address spoofing via malformed RFC 2047 encoded-words
CVE-2026-63435
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Ut
Composer: Perforce source URL permits P4PORT `rsh:` command execution
CVE-2026-84361
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
CVE-2026-84311
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/
pypdf: Possible infinite loop for TreeObject.insert_child
CVE-2026-84309
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree
Filament: Password validity disclosure for accounts denied panel access on login page
CVE-2026-84307
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
CVE-2026-84303
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/
Wyoming < 1.10.2 SSRF via uri Query Parameter
CVE-2026-8712
Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with ne
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an...
CVE-2026-84377
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdent...
CVE-2026-49249
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allo...
CVE-2026-45730
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnera
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attac...
CVE-2026-20355
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco