今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-84650
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowin
CVE-2026-84649
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included
CVE-2026-84648
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source
CVE-2026-84647
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deseriali
CVE-2026-84645
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in indepen
CVE-2026-78689
Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable thr
CVE-2026-78410
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before
CVE-2026-78409
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory
CVE-2026-78408
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across
CVE-2026-78222
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX wo
CVE-2026-77180
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configura
CVE-2026-66842
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts th
CVE-2026-63020
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error mes
CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffe
CVE-2026-19475
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the
CVE-2026-18329
Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asy
CVE-2026-18058
The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack,
CVE-2026-14199
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z
CVE-2026-12704
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo fi