Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation
CVE-2026-48486
Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algori
2026-09-04 归档
今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
CVE-2026-75036
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet co
Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
CVE-2026-75035
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user,
Rancher: SAML Assertion Replay
CVE-2026-75034
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recor
Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
CVE-2026-75033
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io
Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
CVE-2026-71404
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settabl
MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
CVE-2026-85230
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widge
Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints
CVE-2026-85213
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueE
CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
CVE-2026-85212
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
CVE-2026-85210
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registere
Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
CVE-2026-85183
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to es
CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
CVE-2026-85181
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attac
CRMEB through 6.0.0 Unauthorized Message Modification via edit_message
CVE-2026-85177
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allo
ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload
CVE-2026-85135
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::upload
MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
CVE-2026-85216
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficien
n8n before 2.36.2 Missing Authorization via Insights API
CVE-2026-85173
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that all
n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
CVE-2026-85172
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exp
n8n before 1.123.73 Credential Exposure via Error Logging
CVE-2026-85171
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailch
n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
CVE-2026-85170
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail comp
n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
CVE-2026-85169
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI re