Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST AP
2026-09-11 归档
今日共收录 1356 条安全情报，包含 483 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input
CVE-2026-15461
The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embe
Suricata lua/tls: null dereference in TlsGetCertInfo
CVE-2026-45747
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr
Suricata http2: decompression bomb can cause denial of service in Suricata
CVE-2026-46387
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr
ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion
CVE-2026-75584
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to cras
ICEcoder through 8.1 Path Traversal via oldFileName Parameter
CVE-2026-64838
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, al
ICEcoder through 8.1 OS Command Injection via lib/properties.php
CVE-2026-64837
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authentica
ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
CVE-2026-64836
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error i
MISP: Unescaped HTML Injection in PDF Report Element Rendering
CVE-2026-88921
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for re
Suricata lua: sandbox allocation limit not enforced for new allocations
CVE-2026-45763
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. St
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
CVE-2026-88896
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates
Renovate before 44.14.7 Command Injection via distributionType
CVE-2026-88889
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to
Renovate before 44.14.7 Command Injection via Mix organization
CVE-2026-88888
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependenci
Renovate before 44.11.2 Credential Exfiltration via Link Header
CVE-2026-88887
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagin
Renovate before 44.14.7 Command Injection via gradle-wrapper
CVE-2026-88886
Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions be
Renovate before 44.14.7 Command Injection via depName
CVE-2026-88885
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depNam
Renovate before 44.3.1 Authentication Bypass via Digest Updates
CVE-2026-88884
Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0
Renovate before 44.14.4 TLS Private Key Log Sanitisation
CVE-2026-88883
Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.
Renovate before 44.11.2 Credential Exfiltration via Link Header
CVE-2026-88882
Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts b
Renovate before 44.11.3 Credential Exfiltration via Link Header
CVE-2026-88880
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing mal